Anthropic accuses Alibaba of campaign to illicitly extract AI capabilities, citing letter alleging a large distillation attack

Anthropic has accused Alibaba of mounting a “brazen” and “illicit” effort to extract its AI capabilities, according to a letter obtained by CNBC on June 24. The dispute centers on claims that Alibaba executed what Anthropic describes as the largest known “distillation attack” on Anthropic to date, involving attempts to replicate an external model’s behaviors through repeated access and data collection.

In the letter, Anthropic alleges Alibaba used an automated process to query Anthropic’s systems in a way that could allow an adversary to produce a substitute model. Anthropic characterizes the conduct as falling outside ordinary, permitted use and as raising substantial security concerns for businesses and users that rely on commercial AI services.

Anthropic’s complaint is framed around the concept of distillation attacks, a class of techniques in which an attacker trains a separate model by observing outputs from a target model. Anthropic says its assessment indicates the scale of the activity went beyond prior known incidents, describing the campaign as exceptionally large and targeted compared with earlier examples.

The allegations arrive as AI providers, cloud operators, and customers increasingly confront security, compliance, and governance issues tied to model access. For Anthropic, the practical concern is that a successful distillation campaign could undermine the protective value of its systems, shifting competitive and security risks from abstract theory to operational reality.

The CNBC report does not, in the materials it describes, provide independent third-party verification or an adjudicated finding. Alibaba’s response is not included in the information provided here, meaning the claims remain allegations tied to Anthropic’s letter rather than a final determination.

If Anthropic’s assertions are substantiated, the case could intersect with contractual terms, platform access rules, and broader questions about how AI systems are protected against misuse at the interface layer. That includes monitoring and limiting suspicious access patterns, as well as strengthening enforcement mechanisms for customers or partners whose activity overlaps with extraction tactics.

Anthropic has previously faced an environment where AI capability protections are tested through large-scale probing, and disputes over access controls are likely to remain a recurring issue as competition in foundation models and AI assistants intensifies. For now, the immediate next step would be whether Anthropic pursues further internal remediation, expands legal or regulatory efforts, or takes steps with relevant intermediaries to address the alleged campaign.

For users and enterprises, the episode underscores a governance problem with real-world consequences: when model providers face extraction attempts, the downstream effect can include changes to rate limits, access policies, and monitoring practices that may affect legitimate customers as well as bad actors.