Anthropic Ties 151 Million Claude Exchanges to an Alleged Alibaba Distillation Campaign

Anthropic released its September 2026 threat intelligence report on Wednesday, covering misuse it says it detected and disrupted between December 2025 and August 2026 across seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation.

The largest single case involves distillation. Anthropic says accounts it links to Alibaba conducted more than 151 million exchanges with Claude models between May and July 2026, spread across roughly 3,500 accounts that all used one fixed prompt designed to extract the model's chain of thought. Because the prompt was identical across accounts, Anthropic attributes the traffic to a single coordinated effort to build training data for the Qwen model family. TechCrunch reports that the Alibaba case was the largest of five campaigns Anthropic attributes to China-based AI companies, with smaller volumes tied to DeepSeek, Moonshot AI and MiniMax. CNBC notes that this follows a June accusation from Anthropic against Alibaba over a separate, earlier extraction effort.

What is confirmed here is limited. Anthropic controls the logs, the account data and the attribution method, and it is also the commercial party harmed if Qwen closes the capability gap using Claude's outputs. The companies Anthropic names have not, by its own account, admitted to the activity. A shared prompt appearing across thousands of accounts is reasonable evidence of coordination, but tying those accounts to a specific corporate owner is a judgment call that no outside party has yet reproduced. The exchange counts should be read as Anthropic's own measurement of its own service, not as an independently confirmed finding.

The report also describes a broader shift in who can carry out advanced operations. Anthropic argues that model assistance across reconnaissance, tooling, data processing, exploitation and exfiltration lets less skilled operators achieve results that previously required experienced teams, a framing CyberScoop summarizes as small actors running state-level campaigns. Anthropic also describes a new category of actors building software for firearms, missiles, armed drones and munitions, and says it blocked attempts at research relevant to biological weapons.