Version 3

Anthropic has accused Alibaba of the largest known distillation attack on Claude, using approximately 25,000 fraudulent accounts to generate 28.8 million exchanges between April 22 and June 5, 2026, specifically targeting agentic reasoning and software engineering capabilities.[1][2] Anthropic disclosed the campaign to the U.S. government, sent a confidential letter to two senators before a congressional hearing, and has since cut off Chinese companies that accessed Claude through shell companies, VPNs, and proxies.[4][1][5] Separately, internal Meta documents show applied AI engineers are restricted from using Claude Code and Codex to prevent competitor outputs from entering training pipelines.[6] And Anthropic has acknowledged hidden markers inside Claude Code that flagged requests routed through China-linked proxy servers — and has promised to remove them.[13][14]

The Alibaba episode has moved from allegation to active enforcement: Anthropic is cutting off access, briefing Congress, and disclosing to the U.S. government. The fingerprinting acknowledgment is significant separately — Anthropic was covertly marking system prompts in an agentic tool with elevated permissions to read files and run commands, and only disclosed and reversed this after public exposure.

Anthropic publicly accused Alibaba of conducting the largest known distillation attack on Claude, using approximately 25,000 fraudulent accounts to generate 28.8 million exchanges between April 22 and June 5, 2026.[1][2] The campaign specifically targeted Claude's most valuable capabilities — agentic reasoning, software engineering, and long-horizon tasks — in what Anthropic described as a brazen and illicit extraction of AI capabilities.[1][3] Anthropic sent a confidential letter to Senators Tim Scott and Elizabeth Warren on June 10, the day before a Senate hearing on AI and U.S.-China competition, framing the incident as both a terms-of-service violation and a national security matter.[1] Anthropic also disclosed the campaign to the U.S. government and has taken active enforcement steps, cutting off Chinese companies that had been accessing Claude through shell companies in Singapore, VPNs, and proxy servers.[4][5] Alibaba has not issued any public response.

Internal documents obtained by The Information show Meta restricted applied AI engineers from using Claude Code and Codex, citing the risk that competitor tool outputs — code suggestions, design choices, explanations — could enter Meta's training pipelines and constitute inadvertent distillation.[6][7] Analyst Rohan Paul proposed mitigations including ingredient tracking and clean-room separation between coding-agent outputs and training data.[8] Legal experts have noted that ToS anti-distillation clauses may be difficult to enforce in court, particularly against foreign entities — though Anthropic's documented evidence of fake accounts and systematic large-scale API use would strengthen any enforcement case.[9][8]

A third development concerns Claude Code itself. Rohan Paul reported that Claude Code was detecting when ANTHROPIC_BASE_URL pointed to a China-linked custom hostname and covertly embedding invisible markers — punctuation and date-formatting signals — into system prompts, which users could neither see nor refuse because they were not disclosed in the tool's interface.[10] The allegation spread through mainstream tech coverage, with multiple outlets reporting on hidden attribution markers inside Claude Code.[11][12] Anthropic acknowledged the behavior and promised to remove the markers.[13][14] Paul's underlying concern — that covert prompt modification inside an agentic tool with permissions to read files, edit code, and run commands crosses a user trust line regardless of the detection rationale — remains unaddressed by Anthropic's response.