Artificial intelligence companies are spending billions of dollars training cutting-edge models. Now, a new dispute between Anthropic and Alibaba has put the spotlight on a controversial practice that some experts describe as the AI industry’s newest intellectual property battleground. Anthropic has accused Alibaba’s Qwen AI lab of carrying out what it calls the largest known “adversarial distillation attack” against its Claude AI models. According to the company, the alleged campaign involved nearly 29 million interactions over six weeks to extract valuable AI capabilities.
The allegations have intensified concerns over AI model theft, intellectual property protection, and the growing technological rivalry between the United States and China.
What is AI cannibalism?
The phrase “AI cannibalism” is an informal way to describe one AI model learning from another AI model’s outputs rather than from human-created datasets.
In most cases, this happens through a technique called AI distillation.
Model distillation itself is not inherently controversial. It is a widely accepted machine learning technique when performed using models that developers own or have permission to use.
The controversy begins when companies allegedly use competitors’ commercial AI systems without authorization to recreate their capabilities.
Instead of investing years of research and billions of dollars to train an advanced large language model, a competitor can repeatedly query an existing model, collect its responses, and use them as training data for its own system.
That is the practice Anthropic claims occurred in this case.
What is an adversarial distillation attack?
How AI distillation normally works
Traditional model distillation involves:
- A powerful “teacher” model
- A smaller “student” model
- Training the student to mimic the teacher’s responses
This approach helps developers create faster, cheaper AI models while preserving much of the original model’s performance.
When does it become adversarial?
According to Anthropic, an adversarial distillation attack occurs when another organization repeatedly queries a commercial AI model without permission to harvest large volumes of high-quality responses.
Those responses can then be used to improve another AI model without access to the original model’s internal architecture or training data.
In simple terms:
- Ask an advanced AI millions of carefully designed questions.
- Save every response.
- Train another AI using those responses.
- Reproduce many of the original model’s capabilities at a much lower cost.
That is why companies increasingly view such activity as a form of AI intellectual property theft.
What exactly is Anthropic accusing Alibaba of?
Anthropic says it submitted a formal complaint ahead of a US Senate hearing on artificial intelligence.
According to the company:
- Approximately 25,000 fraudulent accounts allegedly interacted with Claude.
- More than 28.8 million exchanges occurred between April 22 and June 5, 2026.
- The activity allegedly originated from operators connected to Alibaba’s Qwen AI lab.
- The campaign allegedly violated Claude’s terms of service and geographic restrictions.
Anthropic described the operation as the largest known distillation attack against its AI models.
It also alleged that the activity specifically targeted Claude’s most commercially valuable capabilities.
The capabilities allegedly targeted
According to Anthropic, the campaign focused on extracting:
- Advanced reasoning
- Software engineering
- Programming and coding assistance
- Autonomous task execution
- Agentic AI behavior
- Long-horizon planning
- Complex decision-making
These capabilities represent some of the most expensive and difficult aspects of modern AI development.
Why would companies use AI distillation?
Training a frontier AI model requires enormous computing resources.
Developing models like Claude, GPT, Gemini, or Qwen involves:
- Massive GPU clusters
- Billions of training examples
- Months of computation
- Multi-billion-dollar infrastructure investments
Using another AI model’s outputs can dramatically reduce those costs.
Developers can improve their own systems without repeating every stage of the original training process.
That makes distillation attractive, especially for companies trying to narrow the gap with leading AI labs.
Why does this matter?
AI intellectual property is becoming increasingly valuable
Unlike traditional software, AI models contain knowledge learned from enormous datasets and extensive computational training.
Protecting those capabilities has become a major business priority.
If competitors can cheaply replicate years of expensive research, companies argue it undermines incentives for innovation.
National security concerns
The dispute also reflects growing geopolitical tensions surrounding artificial intelligence.
Anthropic argues that protecting advanced AI models is no longer just a commercial issue but also a national security concern.
The company says increasingly capable AI systems could have military, cybersecurity, and strategic applications, making unauthorized capability extraction more significant than ordinary copyright disputes.
Is this the first time Anthropic has raised these concerns?
No.
Anthropic says it previously detected similar but much smaller campaigns involving other Chinese AI developers.
According to the company, earlier alleged activity included the following:
- Around 150,000 exchanges from DeepSeek
- More than 3.4 million exchanges from Moonshot AI
- Roughly 13 million exchanges from MiniMax
Anthropic claims the alleged Alibaba campaign was significantly larger than those earlier cases.
How has the US government responded?
The controversy coincides with broader US efforts to restrict advanced AI technology exports.
According to Anthropic:
- The US Department of Commerce recently restricted access to Anthropic’s newest AI models, citing national security concerns.
- Anthropic subsequently limited the global availability of those models.
- Alibaba has also challenged its inclusion on a US Department of Defense list identifying certain Chinese companies with alleged military ties.
The timing has added another layer to the ongoing AI competition between Washington and Beijing.
What happens next?
Anthropic has called for stronger cooperation between government agencies and AI companies to detect and prevent large-scale model extraction.
Among its proposals are:
- Better threat intelligence sharing
- Stronger enforcement against AI intellectual property theft
- Increased monitoring of suspicious AI usage
- Tougher penalties for large-scale unauthorized model extraction
Whether regulators ultimately classify adversarial AI distillation as a new form of intellectual property infringement remains an open question.
What is clear is that as AI models become more capable and more expensive to build, protecting those capabilities is emerging as one of the defining legal and commercial challenges of the AI era.
TL;DR
- Anthropic alleges Alibaba’s Qwen AI lab conducted nearly 29 million “adversarial distillation” interactions with Claude AI.
- The company claims around 25,000 fraudulent accounts were used over six weeks.
- Distillation allows developers to train AI models using another AI model’s responses instead of building capabilities entirely from scratch.
- Anthropic says the campaign targeted Claude’s reasoning, coding, and autonomous task capabilities.
- Alibaba has not admitted wrongdoing, and the allegations have renewed debate over AI intellectual property protection and global AI competition.
