The 28.8 Million Question: Anthropic Catches Alibaba Red-Handed, and Nobody's Talking About What Comes Next

Let me tell you a story about the biggest AI heist you've never heard enough about.

In June, Anthropic dropped a letter on the U.S. Senate Banking Committee that should've sent shockwaves through the entire tech industry. Instead, it got a few headlines and then — crickets. So allow me to do what I do best: cut through the BS and tell you what actually happened, why it matters, and why sitting on the sidelines is the most dangerous thing any of us can do right now.

The Numbers That Should Scare You

Between April 22 and June 5, 2026 — just six weeks — operators affiliated with Alibaba and its Qwen AI lab ran 28.8 million exchanges with Anthropic's Claude AI model through nearly 25,000 fraudulent accounts.

Let that sink in. Twenty-five thousand fake accounts. Nearly thirty million conversations. All designed to do one thing: steal Claude's capabilities by systematically extracting what makes the model tick. This is what the industry calls a "distillation attack" — a fancy way of saying "industrial-scale intellectual property theft, executed with military precision."

Anthropic's head of policy, Sarah Heck, sent the letter on June 10, addressed to Chairman Tim Scott and Ranking Member Elizabeth Warren. The letter doesn't mince words. It calls this "the largest known distillation attack on Anthropic to date." And it's not just a press release — it's evidence submitted to Congress, with copies sent to the White House.

This isn't a PR spat. This is an American AI company handing the federal government a smoking gun.

What Is Distillation, and Why Should You Care?

Here's the part the press releases won't say clearly: model distillation is the AI equivalent of industrial espionage.

You take a frontier model like Claude — one of the most advanced AI systems in the world, built at enormous cost by American engineers, funded by American capital — and you poke at it. Millions and millions of times. You ask it questions, you record its outputs, and you use those outputs to train a cheaper, faster copycat model that gets most of the intelligence without paying for the R&D.

It's like spending a billion dollars designing a jet engine, and then someone takes 25,000 photos of it from every angle, runs them through a 3D scanner, and starts printing knockoffs in a garage. Except in AI, the theft is invisible. No factory raid. No stolen hard drives. Just 28.8 million API calls spread across thousands of fake accounts, designed to look like normal usage until you zoom out and see the pattern.

And here's the real gut punch: Anthropic already caught DeepSeek, Moonshot AI, and MiniMax doing this back in February 2026. They published detailed technical evidence. They named names. And six weeks later, Alibaba's lab started doing the same thing, at a scale that dwarfed everything before it.

So much for deterrence.

The Bigger Picture Nobody Wants to Admit

Here's where it gets uncomfortable, folks. Dario Amodei, Anthropic's CEO, has been warning for months that open-source AI is on a "very dangerous path." He's called for government veto power over dangerous AI deployments. He wants the U.S. government to block models the way the FAA blocks unsafe airplanes.

And you know what happened? A huge chunk of the AI community accused him of trying to build a regulatory moat. "He just wants to protect his business," they said. "Safety rhetoric is just a competitive strategy."

Well, folks — Alibaba just made Amodei's argument for him. With receipts.

Because the uncomfortable truth is this: while we've been debating whether safety is real or just marketing, Chinese AI labs have been systematically strip-mining American AI capabilities. Not through some futuristic cyberwarfare — through boring, old-fashioned fraud. 25,000 fake accounts. A six-week extraction campaign. And this is just the one they caught.

Now, I'm not here to tell you that all Chinese AI is stolen or that open-source is evil. That's nonsense. Some of the best AI research in the world is coming out of Chinese labs — DeepSeek's Mixture-of-Experts architecture, Qwen's reasoning improvements, legitimate innovations that stand on their own merit. The problem isn't competition. Competition is healthy. The problem is theft dressed up as competition.

Meanwhile, Meta Is Building an AI Cloud Empire

Let me hit you with another story that broke the same week and got even less attention than the Alibaba drama.

Bloomberg reported on July 1 that Meta is building a cloud infrastructure business to sell its excess AI computing capacity. Internally called "Meta Compute," the initiative would sell raw AI compute power (competing with CoreWeave and the neoclouds) and hosted access to Meta's own AI models (competing with AWS Bedrock). Mark Zuckerberg has been saying for over a year that the industry is compute-constrained and Meta intends to own as much of it as humanly possible.

Now, I love the irony here. Meta — the company that got roasted for releasing LLaMA as open-source, the company that Mistral and others followed in releasing powerful open-weight models — is now building a walled garden to sell compute.

It's almost like the open-source enthusiasm starts to look different when you've got tens of billions in infrastructure to monetize.

But here's the connection that matters: every single piece of the AI stack is becoming a national security question. The compute infrastructure. The models. The data. The distillation attacks. The fake accounts. We are watching the early stages of a technological arms race play out in real time, and most coverage is treating it like business-as-usual tech drama.

What This Actually Means

Let me give you the take the sanitized press releases won't:

First: If Alibaba can run 28.8 million extraction queries through 25,000 accounts without getting caught immediately, so can every other state-backed lab in the world. This isn't a one-off. It's a proof of concept. And the fact that Anthropic caught this one means there are probably a dozen campaigns they haven't caught yet.

Second: The "open everything" era of AI is going to collide hard with national security reality. The same people who cheered when Meta released LLaMA are going to have to reckon with the fact that those same open-weight models are being used by adversaries to bootstrap their own capabilities. You can't have "AI for everyone" and "AI security" without serious tradeoffs, and pretending otherwise is just wishful thinking.

Third: Congress needs to actually do something. Not a hearing. Not a strongly worded letter. Legislation. Anthropic is asking for the ability to treat capability extraction as theft under U.S. law, and frankly, that's the bare minimum. If 28.8 million stolen conversations aren't enough to move the needle, nothing will be.

Stay Vigilant, Stay Angry

Here's what I want you to take away from all this: the AI industry is not a spectator sport. Every time you read about one of these stories and scroll past, you're watching the rules of the next decade get written by the people who benefit from having no rules at all.

Call your representatives. Ask them what they know about model distillation and what they're doing about it. Share this article. Talk about it. The only thing worse than a dangerous technology is a dangerous technology that nobody's paying attention to until it's too late.

I'm Jessica Ali, and this is your reminder that cutting through the BS isn't optional — it's survival.

Sources: Anthropic letter to the U.S. Senate Banking Committee (June 10, 2026), CNBC, Reuters, BBC, Bloomberg, TechCrunch.