"Built on Stolen Technology?" Repeated Allegations of Chinese AI Model Copying Fuel Broader U.S. Tech Containment Efforts

Anthropic Revelations Reignite Chinese AI Model Distillation Allegations
28.8 Million Conversations Extracted Through 25,000 Fraudulent Accounts
Recurring Unauthorized Output Harvesting Intensifies U.S. Security Concerns

U.S. artificial intelligence (AI) company Anthropic has disclosed evidence suggesting that Chinese technology giant Alibaba engaged in the unauthorized appropriation of its technology. The allegations carry greater significance because they follow a series of similar cases involving Chinese AI companies including DeepSeek, Moonshot AI, and MiniMax. As Washington continues to tighten export controls on advanced AI semiconductors and computing infrastructure, suspicions that Chinese firms attempted to enhance their models by harvesting outputs from leading frontier AI systems have elevated AI technology leakage into a critical factor shaping broader U.S. technology security policy toward China.

Alibaba Allegedly Used Fake Accounts to Train on Claude

According to Bloomberg on June 25 (local time), Anthropic recently told U.S. senators and White House officials in a letter that operators linked to the laboratory behind Alibaba's AI model Qwen exchanged 28.8 million conversations with Claude beginning in April by using 25,000 fraudulent accounts. Anthropic said the operators specifically targeted Claude's core capabilities, including software engineering and agentic reasoning.

Anthropic characterized the activity as a "distillation attack." Distillation refers to a technique in which outputs generated by a highly capable model are collected at scale to train a smaller, lower-cost model. By employing this method, developers can build AI chatbots that replicate the performance of more advanced systems without incurring the enormous research and development (R&D) expenses or infrastructure investments required to create frontier models. While distillation itself has legitimate research applications, systematically replicating another model's core capabilities in violation of service terms constitutes clear free-riding.

In the letter, Anthropic stated that "these distillation attacks are being conducted illegally and systematically at industrial scale to harvest America's advanced AI capabilities and repackage them as domestic innovations," adding that "AI systems built through such methods often lack even basic safety guardrails." The company urged the U.S. government to intervene and strengthen enforcement. Anthropic further said Alibaba specifically targeted Claude's most commercially valuable capabilities—software engineering and agentic reasoning. It described the incident as "the largest distillation attack ever conducted against Anthropic" and "the most significant attempt by a Chinese company to free-ride on the achievements of a leading U.S. AI laboratory."

The latest allegations are far from the first involving Chinese AI companies. In February, Anthropic disclosed that Chinese AI laboratories including DeepSeek, Moonshot AI, and MiniMax extracted model capabilities through more than 16 million interactions with Claude conducted via roughly 24,000 fraudulent accounts. Earlier this year, OpenAI also warned U.S. lawmakers about AI distillation by Chinese firms in a policy proposal submitted to Congress. At the time, OpenAI and Microsoft were reportedly investigating large-scale API activity originating from accounts suspected of being linked to DeepSeek. Evidence of China's growing reliance on AI distillation also emerged in Tencent's AI model Hy3 Preview, unveiled last month. U.S. technology publication The Information reported that Tencent employees used Anthropic's Claude Code coding assistant during Hy3's development process. Human evaluators reportedly benchmarked Hy3 against Claude throughout training and evaluation to improve the model's final performance.

Companies, Government, and Congress Mount Coordinated Response

As Chinese AI model copying intensifies, OpenAI, Anthropic, and Google have begun coordinating defensive measures despite competing fiercely in the commercial AI market. Through the Frontier Model Forum—a nonprofit organization established by Microsoft in 2023—the three companies have shared information since April to detect hostile attempts to extract model data. They are cooperating to improve detection of external attack techniques, identify responsible actors, and block unauthorized access.

The U.S. government has also escalated its criticism of China. In April, Michael Kratsios, Director of the White House Office of Science and Technology Policy, warned that foreign organizations led by China were conducting "industrial-scale distillation campaigns" targeting American AI systems. U.S. officials believe these operations are primarily being carried out by China-based entities using tens of thousands of proxy accounts and jailbreaking techniques to circumvent security protections and obtain non-public information. Jailbreaking refers to methods that disable an AI system's safety and ethical safeguards to elicit information that would otherwise remain inaccessible. Kratsios argued that "AI models built on such a fragile foundation cannot guarantee integrity or trustworthiness." His remarks came ahead of the U.S.-China summit held during President Donald Trump's visit to China last month, prompting speculation that the issue could emerge as a key agenda item.

The U.S. State Department has also taken formal diplomatic action. On May 24, it sent a diplomatic cable to U.S. embassies and consulates worldwide instructing diplomats to raise concerns with foreign governments regarding Chinese companies' attempts to "extract and distill" American AI models. The directive closely followed a memorandum circulated on May 23 by the White House Office of Science and Technology Policy, which warned federal agencies that foreign actors were systematically extracting American innovations through tens of thousands of proxy accounts and jailbreaking techniques. In the diplomatic cable, the State Department explicitly identified DeepSeek, Moonshot AI, and MiniMax, stating that "hostile actors' extraction and distillation of U.S. AI models is a matter of serious concern."

Congress has likewise begun pursuing legislative action. Republican Senator Bill Hagerty and Democratic Senator Andy Kim plan to introduce an amendment to the annual National Defense Authorization Act (NDAA) that would authorize the U.S. government to blacklist or sanction Chinese companies found to have improperly harvested outputs from American AI models to train competing systems. A similar bipartisan defense measure is reportedly being prepared in the House of Representatives. Earlier this month, the U.S. Department of Defense also added Alibaba to its blacklist of companies identified as supporting China's military.

Growing Doubts Over China's AI Rise

Experts believe the controversy is unlikely to remain an isolated incident. As competition for AI leadership increasingly evolves into geopolitical rivalry, the issue is expected to resurface repeatedly in future White House technology security policies toward China as well as in bilateral U.S.-China negotiations. Within the American technology industry, skepticism surrounding China's rapid AI rise has already intensified. Chinese companies have aggressively challenged U.S. dominance by offering high-performance, low-cost AI models. However, with Alibaba now joining DeepSeek, Moonshot AI, and MiniMax in facing allegations of improperly absorbing outputs from leading American AI models, confidence in the legitimacy of China's AI development trajectory has come under growing scrutiny.

Concerns surrounding AI technology theft extend beyond model outputs. In January, the U.S. Department of Justice announced that former Google software engineer Linwei Ding had been convicted of charges related to misappropriating Google's AI trade secrets for the benefit of China. Investigators found that Ding transferred more than 2,000 pages of confidential documents concerning Google's AI data centers and machine learning infrastructure to a personal cloud account while employed at the company. The materials reportedly included critical design and operational information for Google's Tensor Processing Units (TPUs), Graphics Processing Units (GPUs), SmartNICs, and other large-scale AI training infrastructure.

These developments underscore that Washington's concerns over China's AI advancement extend well beyond disputes between private companies. On one front, authorities have detected large-scale efforts to harvest outputs from frontier AI models such as Claude and ChatGPT. On another, they have uncovered theft of trade secrets involving AI data centers and semiconductor infrastructure. Model performance, training data, computing infrastructure, and talent mobility are increasingly being treated as components of a single technology security battlefield. Longstanding allegations of technology theft and talent poaching associated with China's industrial development have further reinforced U.S. concerns. Industrial espionage controversies that previously centered on semiconductors, batteries, and telecommunications equipment have now expanded into AI models and cloud infrastructure. Because generative AI systems embody enormous investments in capital, data, and engineering expertise, even unauthorized collection of model outputs has the potential to erode the competitive advantage of leading developers.

Meanwhile, China's AI capabilities are already approaching those of the United States. According to the 2026 AI Index report released by Stanford University's Institute for Human-Centered Artificial Intelligence, the performance gap between the leading AI models of the United States and China has narrowed to just 2% to 3%. In April, DeepSeek unveiled its V4 Pro model, developed using Huawei semiconductor chips, claiming significant improvements in reasoning and agentic capabilities. Although DeepSeek acknowledged that V4 Pro-Max still trails Anthropic's Claude Opus 4.6 and Google's Gemini 3.1 Pro in overall performance, the model has been widely praised for its strong price competitiveness, with a monthly subscription costing approximately $3.50 compared with $25 for Claude Opus 4.6.