Version 4

Anthropic publicly accused Alibaba of the largest known distillation attack on Claude, involving approximately 25,000 fraudulent accounts generating 28.8 million exchanges between April 22 and June 5, 2026.[1][2] Anthropic disclosed the campaign to the U.S. government and Congress and has cut off Chinese companies that accessed Claude through shell companies, VPNs, and proxies.[4][5] A separate controversy emerged when Claude Code was found to embed invisible markers in system prompts to flag requests routed through China-linked proxy servers; Anthropic acknowledged the behavior and promised to remove it.[7][8] Alibaba has since blocked Claude Code internally — not in response to the distillation allegations, which it has not addressed publicly, but in response to the fingerprinting disclosure.[9]

Alibaba blocking Claude Code is the first concrete counter-move in this dispute, and it is directed at the fingerprinting controversy rather than the distillation accusations — suggesting the covert marking of system prompts may have done more immediate damage to Anthropic's standing with the party it was trying to surveil than the underlying accusations have. Anthropic embedded hidden signals in an agentic tool with permissions to read files and run commands, disclosed this only after public exposure, and the consequence is that the targeted party has now cut off access to the tool entirely.

Anthropic publicly accused Alibaba of conducting the largest known distillation attack on Claude, using approximately 25,000 fraudulent accounts to generate 28.8 million exchanges between April 22 and June 5, 2026.[1][2] The campaign specifically targeted Claude's most valuable capabilities — agentic reasoning, software engineering, and long-horizon tasks — in what Anthropic described as a brazen and illicit extraction of AI capabilities.[1][3] Anthropic sent a confidential letter to Senators Tim Scott and Elizabeth Warren on June 10, the day before a Senate hearing on AI and U.S.-China competition, framing the incident as both a terms-of-service violation and a national security matter.[1] Anthropic also disclosed the campaign to the U.S. government and has taken active enforcement steps, cutting off Chinese companies that had been accessing Claude through shell companies in Singapore, VPNs, and proxy servers.[4][5] Alibaba has issued no public statement on the distillation allegations.

A separate controversy emerged around Claude Code itself. Rohan Paul reported that Claude Code was detecting when ANTHROPIC_BASE_URL pointed to a China-linked custom hostname and covertly embedding invisible markers — punctuation and date-formatting signals — into system prompts to tag requests routed through those proxies, without user disclosure or opt-in.[6] Anthropic acknowledged the behavior and promised to remove it, characterizing the feature as an experiment aimed at stopping API resellers and model distillation, not targeted surveillance.[7][8][9] The admission prompted Alibaba to block Claude Code internally, with Chinese developers and security staff reportedly angered by the discovery.[9] Paul argues the framing distinction matters less than the mechanism: Claude Code has permissions to read files, edit code, and run commands, making hidden prompt modification in that context more consequential than ordinary app-level telemetry — and he contends that once invisible characters carry metadata in agentic tools, users will distrust even harmless-looking text.[9]

Internal Meta documents show the company restricted applied AI engineers from using Claude Code and Codex, citing the risk that competitor tool outputs could enter Meta's training pipelines and constitute inadvertent distillation.[10][11] Legal experts have noted that ToS anti-distillation clauses may be difficult to enforce in court against foreign entities, though Anthropic's documented evidence of fake accounts and systematic large-scale API use would strengthen any enforcement case.[12] Analyst Rohan Paul proposed technical mitigations including ingredient tracking and clean-room separation between coding-agent outputs and training data.[13]

The Alibaba episode illustrates a collision of two enforcement problems: labs trying to detect and stop systematic API abuse cannot easily do so through disclosed means without tipping off the abuser, while covert mechanisms in agentic tools undermine the user trust that makes those tools valuable. Anthropic's acknowledgment and reversal resolves neither the underlying detection problem nor the broader question of whether its ToS provisions against distillation have any practical enforcement path against a foreign company.