Version 2

Anthropic has publicly accused Alibaba of the largest known distillation attack on Claude, using approximately 25,000 fraudulent accounts to generate 28.8 million exchanges intended to train Alibaba's own models, and disclosed the campaign to the U.S. government.[2][3][1] Separately, internal Meta documents show the company has restricted applied AI engineers from using Claude Code and Codex to prevent competitor outputs from contaminating Meta's training pipelines.[6][13] A third development: an allegation surfaced that Claude Code covertly fingerprints API requests routed through China-linked proxy servers by injecting invisible punctuation and date-formatting markers into prompt text — a countermeasure critics argue violates user trust in a tool with elevated system permissions.[11] Alibaba has not publicly responded to Anthropic's accusations.

These cases together show that distillation — using a competitor's model outputs as training data — has become an active area of commercial conflict, with labs both detecting violations and defending their own pipelines. The fingerprinting allegation adds a complication: the detection methods themselves may undermine user trust if implemented covertly inside an agentic tool that can read files, edit code, and run commands.

Anthropic disclosed to the U.S. government that Alibaba orchestrated the largest known distillation attack on Claude.[1] The operation used approximately 25,000 fraudulent accounts to generate 28.8 million exchanges with the model, apparently to produce labeled input-output pairs that could train Alibaba's own systems on Claude's behavior.[2][3] Anthropic described the campaign as 'brazenly' and 'illicitly' extracting AI capabilities.[4] Zvi Mowshowitz confirmed Anthropic's formal accusation against Alibaba and situated it within broader U.S.-China AI competition.[5] Alibaba has not issued any public response.

Internal documents obtained by The Information show Meta has prepared guidelines restricting how engineers in its applied AI division use Claude Code and Codex.[6] The concern is straightforward: competitor AI tool outputs — code suggestions, explanations, design choices — could enter Meta's model training pipelines and constitute unintentional distillation.[7] Analyst Rohan Paul proposed mitigation strategies including 'ingredient tracking' and clean-room rules separating coding-agent outputs from training datasets.[7] The restriction covers precisely the tools whose providers — Anthropic and OpenAI — explicitly bar use of their model outputs to develop competing AI models.[8]

The legal landscape around these prohibitions is uncertain. Both OpenAI's and Anthropic's terms of service prohibit competitive training on outputs, but legal commentators note these clauses may be difficult to enforce in court, particularly against foreign entities.[9][8] A strong enforcement case would typically require evidence of mass scraping, fake accounts, or internal records showing intentional cloning — the kind of evidence Anthropic claims to have against Alibaba.[7] Commentator Prasenjit Sarkar argued the episode shows that 'the bottleneck in AI capability competition just moved from training to policy enforcement.'[10]

A separate allegation adds a new dimension to the detection side of this dispute. Rohan Paul reported that Claude Code allegedly detects when ANTHROPIC_BASE_URL is set to a China-linked custom hostname and covertly marks the request using invisible punctuation and date formatting injected into prompt text — signals users cannot see or refuse because they are not disclosed in the tool's interface.[11] Paul argued that while proxy abuse detection may be understandable given Anthropic's stated concern that proxy services bypass China access limits, covert prompt marking crosses a user trust line for an agentic tool with elevated permissions to read files, edit code, and run commands.[11] Anthropic has not publicly confirmed or denied the allegation. Technical commentator Dr. Luke (@96Stats) separately raised skepticism about press coverage of the distillation story itself, arguing that mainstream outlets mischaracterize what the technique accomplishes — a minority view in the overall coverage.[12]