Anthropic has escalated the AI industry's intellectual property battle by filing a formal complaint with the U.S. Department of Commerce and Singapore's IP office, accusing Alibaba Cloud of conducting a massive "distillation attack" to extract proprietary capabilities from Claude 4 models and replicate them in Alibaba's competing Qwen family. The 27-page complaint alleges that from January to May 2026, Alibaba ran millions of API queries against Claude 4 Opus and Sonnet through third-party resellers and masked accounts, using systematic techniques to reverse-engineer the model's reasoning patterns.

What Is a Distillation Attack and Why Does It Matter?

A distillation attack is not a hack or data breach. Instead, it exploits legitimate API access to build a training dataset by collecting thousands of prompt-and-response pairs, then training a smaller model to imitate the larger one's behavior. The technique costs pennies compared to the billions required to train a frontier model from scratch. If Alibaba successfully cloned Claude 4 for roughly $20 million through distillation, it would undermine the entire economic model of AI development, where companies invest over $1 billion to train cutting-edge models.

Anthropic's complaint rests on several pieces of technical evidence. The company detected 140 million requests from Alibaba-linked internet address ranges using rotating API keys, with queries specifically designed to extract model internals. These queries repeatedly asked Claude to "explain step-by-step" or "output probability scores," hallmarks of data collection for model distillation. Anthropic also found behavioral overlap between Qwen-3-Max and Claude 4, including identical refusal phrases like "I'm unable to comply with that request due to my safety policy" that appear verbatim in both models.

How Did Anthropic Detect the Alleged Attack?

Anthropic's investigation uncovered a suspicious timeline and pattern of evidence that pointed toward systematic extraction:

• Traffic Patterns: Anthropic detected 140 million requests from Alibaba-linked address ranges using rotating API keys, with queries specifically designed to extract model internals through systematic probing and logit extraction.
• Behavioral Fingerprints: Qwen-3-Max replicates unique Claude 4 failure modes, stylistic quirks, and specific refusals not present in other models, suggesting the model was trained to mimic Claude's exact outputs.
• Suspicious Timing: Qwen-3-Max launched on May 28, 2026, showing major jumps in reasoning and coding benchmarks that align precisely with the window of suspected API scraping activity.
• Contract Violation: Alibaba is a Claude API customer through a Singapore entity, and Anthropic's terms explicitly prohibit using model outputs to train competing models.

Anthropic is seeking an injunction to stop the alleged activity, financial damages, and a U.S. export control review of Qwen models. The company has also asked Claude API resellers to cut off suspected Alibaba accounts.

Alibaba Cloud denied the allegations in a statement, saying "Qwen is trained on publicly available data and our own proprietary datasets" and that the company "respects IP rights and complies with all API terms." The company characterized the behavioral overlap as "a natural result of training on similar internet data" and pledged to "cooperate with any inquiry".

What Are the Broader Implications for the AI Industry?

This case represents the first major Big Tech versus Big Tech dispute over model distillation, and it could reshape how AI companies protect their models. If distillation attacks are allowed to proceed unchecked, every API becomes a potential training set for competitors, eliminating the competitive moat that justifies massive R&D investments. The case is forcing regulators and the industry to grapple with a fundamental question: are model outputs protected intellectual property, or are they fair game once a user pays for API access ?

The legal landscape remains murky. U.S. law does not clearly prohibit learning from model outputs, so Anthropic is relying on contract law and trade secrets arguments. OpenAI sued a smaller firm for distillation in 2025, but no ruling has been issued yet. This Anthropic-Alibaba case will likely set a precedent that shapes how all AI labs approach API security going forward.

"Exiy Intelligence has confirmed the AI war just got legal. Anthropic says Alibaba didn't hack Claude, they tutored Qwen on it, one API call at a time. That's distillation. Legal? Maybe. Ethical? No. If you spend $1 billion training a brain, and I copy it for $20 million by asking it questions, your business model is dead," stated Rihan Sami Faisal, Department of Threat Intelligence at Exiy Intelligence.

Rihan Sami Faisal, Department of Threat Intelligence, Exiy Intelligence

How Might Companies Respond to Protect Their Models?

If Anthropic prevails, expect AI labs to harden their APIs with new defensive measures. Companies are likely to implement rate limits on queries, hide logit probability scores, deploy canary prompts that detect suspicious patterns, and strengthen legal terms. Some labs may shift away from open APIs entirely, moving toward "chat as a service" models where users interact through a chat interface rather than accessing raw model outputs.

This shift could paradoxically benefit open-source models like Llama and DeepSeek, which are freely available and cannot be protected through API restrictions. If proprietary APIs become too locked down to use safely, developers may migrate to open alternatives, redistributing power in the AI ecosystem.

The case also signals that regulators will need to clarify whether model outputs constitute protected intellectual property. The U.S. Department of Commerce may accelerate export controls on frontier models, and the outcome could influence how international AI governance develops. For now, the complaint marks a turning point: the era of freely accessible AI APIs may be entering a new phase of legal and technical scrutiny.