Anthropic has disclosed that operators linked to Alibaba's Qwen AI lab used approximately 25,000 fake accounts to generate over 28.8 million interactions with its Claude system between April 22 and June 5, 2026. This marks the largest distillation campaign ever measured, according to the company.
TL;DR
- Anthropic and OpenAI have revealed large-scale distillation campaigns by Chinese AI labs using tens of thousands of fake accounts.
- The campaigns involved 25,000 fake accounts generating 28.8 million interactions with Claude, and 24,000 accounts generating 16 million interactions.
- The Frontier Model Forum, formed by OpenAI, Anthropic, and Google, aims to share intelligence and coordinate defenses against such campaigns.
What happened
Anthropic disclosed that operators linked to Alibaba's Qwen AI lab ran a large-scale distillation campaign, using roughly 25,000 fraudulent accounts to generate more than 28.8 million interactions with its Claude system between April 22 and June 5, 2026. This campaign is described as the largest distillation campaign ever measured by Anthropic.
In February 2026, Anthropic identified a separate wave involving around 24,000 fake accounts that produced 16 million Claude interactions. These campaigns were attributed to operators connected to DeepSeek, Moonshot AI, and MiniMax.
OpenAI has also made similar accusations, sending a memo to Congress in February 2026 accusing DeepSeek of systematic distillation of its models. The Chinese labs reportedly bypass access restrictions by routing through proxy services that manage large networks of fraudulent accounts.
Why it matters
For AI/ML developers, this news highlights the increasing challenge of protecting model IP and the need for robust defenses against adversarial distillation campaigns. Developers may need to implement more sophisticated detection mechanisms to distinguish between legitimate users and bot networks.
Startup founders and tech investors should be aware of the potential regulatory implications. Tightening US export controls could reshape the competitive landscape for AI chip makers, cloud providers, and crypto projects that depend on affordable access to compute and model infrastructure.
The formation of the Frontier Model Forum by OpenAI, Anthropic, and Google indicates a growing industry response to these challenges. The forum aims to share intelligence and coordinate defenses, which could lead to more collaborative efforts in protecting AI models.
Key facts
- Anthropic reported that operators linked to Alibaba's Qwen AI lab used 25,000 fake accounts to generate 28.8 million interactions with Claude between April 22 and June 5, 2026.
- A separate campaign in February 2026 involved 24,000 fake accounts generating 16 million interactions with Claude, attributed to operators connected to DeepSeek, Moonshot AI, and MiniMax.
- OpenAI accused DeepSeek of systematic distillation of its models in a memo to Congress in February 2026.
- The Frontier Model Forum was formed in April 2026 by OpenAI, Anthropic, and Google to share intelligence and coordinate defenses against adversarial distillation campaigns.
- Chinese labs reportedly bypass access restrictions by routing through proxy services that manage large networks of fraudulent accounts.
- Anthropic describes the campaign involving 25,000 fake accounts as the largest distillation campaign ever measured.
Context
Distillation in AI involves feeding a powerful AI model carefully crafted prompts, collecting its outputs, and then using that data to train a cheaper, smaller model that mimics the original's capabilities. This practice is becoming increasingly sophisticated and industrialized.
The revelations come at a time when US policymakers are already weighing additional export controls on AI technologies. These developments could influence regulatory decisions and impact the broader AI ecosystem.
The formation of the Frontier Model Forum highlights the growing need for collaboration among leading AI companies to address the challenges posed by adversarial distillation campaigns. This could set a precedent for future industry responses to similar threats.
