Alibaba, Anthropic: Behind the Distillation Accusations, a War of the Clones?

The battle between American and Chinese AI systems did not remain confined for long to accusations of capability theft. In late June, Anthropic accused operators linked to Alibaba and its Qwen model of querying Claude on an industrial scale in order to distil its performance. In early July, Alibaba banned Claude Code internally, while Beijing claimed to have identified vulnerabilities in Anthropic’s tool. China was also considering restricting foreign access to its own advanced models. In two weeks, a dispute between two companies turned into a new episode in the war over access to AI models.

The operation of which Alibaba is accused allegedly took place between 22 April and 5 June 2026. Operators linked to the Chinese group reportedly generated more than 28.8 million interactions with Claude using nearly 25,000 fraudulent accounts, in order to extract reasoning, coding and agentic orchestration capabilities and reinject them into Qwen. This technique, known as “distillation”, is common in the industry and involves using the responses of a powerful model to train or improve a lighter model. It becomes problematic when the teacher is a competitor, the queries are conducted on a massive scale, access is concealed and the terms of use prohibit using query results to train a rival.

Capability theft and cyberespionage

This lies at the heart of Anthropic’s complaint. Claude is not merely a chatbot: its responses incorporate investments in computing, data, fine-tuning, security, alignment and engineering. Siphoning them off on a large scale amounts, in Anthropic’s view, to turning those investments into raw material for a competitor. Although no ruling has yet definitively established that this constitutes intellectual property theft, this is clearly an unauthorised extraction of capabilities.

The case is all the more serious because it is far from being the first. In February 2026, Anthropic had already accused DeepSeek, Moonshot AI and MiniMax of using Claude to improve their own models through nearly 24,000 fake accounts that generated around 16 million interactions. With a comparable number of accounts, Alibaba reportedly generated almost twice as many interactions, representing a genuine change of scale in both the intensity of the extraction and the industrial weight of the actor concerned.

This adds further tension to an already stormy climate: Washington has been documenting Chinese cyberespionage and the theft of trade secrets for years. On 30 January 2026, the US Department of Justice announced the conviction of Linwei Ding, a former Google engineer, for economic espionage and the theft of AI-related trade secrets for the benefit of China. The FBI describes the systematic appropriation of intellectual property as a major component of the Chinese threat. While it is true that China has a significant history of patent theft and reverse engineering, these cases do not prove Alibaba’s guilt.

The economy of absorption

The Chinese response and the counter-narrative put forward by supporters of open models rest on two ideas. First, distillation is a common industry practice. Second, American laboratories are now condemning a form of extraction that they themselves carried out on a large scale, albeit in a different form, using human creations. Although the two processes are not identical, generative models were indeed built through the mass absorption of texts, images, code, forums, Web pages, books and press content, often before rights holders understood the scale of the appropriation. The Bartz v. Anthropic case highlighted this point in the United States: a judge accepted that the use of books to train models could qualify as fair use, while distinguishing this issue from that of pirated copies.

Europe, for its part, already has a legislative arsenal covering this issue: neighbouring rights for the press, the 2019 directive on copyright and text and data mining, the AI Act concerning the transparency of general-purpose models, the GDPR when datasets or prompts contain personal data, and the Trade Secrets Directive when the issue involves the appropriation of a competitor’s know-how.

The question is no longer simply who is copying what, but whether someone else’s work can be transformed into a strategic asset. This weakens the moral position of the major American laboratories, which appear to discover the violence of extraction only when it is directed against their own models, even though the AI industry already relies on an economy of absorption. Human texts, model outputs, code repositories and usage traces are becoming raw materials.

Revocable dependency

Anthropic accuses Alibaba of crossing a red line. Authors, publishers, developers and media organisations have been asking for years where that line was when their works were being siphoned off by AI systems. It should nevertheless be stressed that American laboratories are justified in seeking to protect the billions they have invested in cutting-edge models against the industrial siphoning of their capabilities.

The likely consequence of this desire for the global market is tighter access. Proprietary laboratories will strengthen identity checks, abuse detection, geographical restrictions, customer audits and contractual clauses. Distillation threatens their business model: if a competitor can extract the capabilities of a frontier model by generating millions of responses, its technological lead melts away like snow in the sun. In the age of closed models, users are discovering another risk: dependency is no longer merely endured; it can be revoked.

Indeed, a closed model is not only opaque or expensive; it can also be withdrawn from the market. The Fable 5 and Mythos 5 episode demonstrated this: on 12 June 2026, Anthropic announced that a US directive required it to suspend access to both models for all foreign nationals, including those outside the United States and even its own foreign employees. Dependence on foreign AI is therefore not merely technical, but political. This is one of the most sensitive issues for Europe.

When Bercy discovers the biases of Chinese AI

European groups have already drawn lessons from this situation and are diversifying their AI suppliers in order to reduce the risk of a sudden shutdown. Yet this diversification is not synonymous with sovereignty; rather, it dilutes dependencies across several American, Chinese and European actors. It allows organisations to continue operating if a supplier closes a model, raises its prices or blocks a particular use, but it does not give Europe control over computing resources, models, data, software supply chains or access conditions.

France encountered this dilemma at Bercy. On 25 June 2026, the Directorate General of the Treasury suspended the trial of HéphAIstos, an internal tool based on Qwen, after employees raised concerns about answers considered slanted or biased regarding China. The tool had been tested since early June by around one hundred employees. Bercy stated that the model was operating in an isolated environment, without Internet access, with no identified backdoor and no detected data transmission, but the risk is not limited to exfiltration.

A model can run offline and still convey the biases, censorship mechanisms or priorities embedded in its training. For an administration, an army, an intelligence service, a bank or a strategic company, the question is not merely where its data goes, but which model interprets it. Hosting a model locally provides only an illusion of sovereignty if the model itself has been shaped by a foreign power. Logically, Qwen was replaced by a Mistral AI model the following day.

Open Chinese models… but not too open

The cybersecurity implications of the case are significant. The capabilities targeted by Anthropic are not merely conversational; they involve code, automation, action planning, tool use and agentic orchestration. If these capabilities spread through distillation, they can accelerate defensive development, but also reduce the cost of accessing offensive uses. States will therefore increasingly treat advanced models as dual-use technologies, at the intersection of software, economic intelligence and information warfare.

This is where the opposition between closed American models and open Chinese models becomes central. The United States still dominates frontier models, but its leading companies mainly distribute them through APIs, subject to conditions and strict control over their use. China, meanwhile, has gained ground through low prices, permissive licences and “open-weight” models—that is, AI models whose trained parameters, or “weights”, are published or made available for download, allowing them to be run, adapted or retrained locally. DeepSeek-R1 was thus released with its code and models under an MIT licence, explicitly inviting users to distil and commercialise it freely. Alibaba has released several Qwen3 models under the Apache 2.0 licence. For markets outside the United States and the European Union, the appeal is clear: lower costs, local adaptation and less immediate dependence on American APIs.

Europe caught between the American hammer and the Chinese anvil

These are not necessarily genuine open-source models, however: according to the Open Source Initiative’s definition, a truly open AI system cannot be reduced to downloadable weights. It must also provide the necessary information about the data, code and parameters required to understand, modify and rebuild the system. Many Chinese models are instead “open-weight” models, which is already important for auditing, self-hosting and adaptation, but does not guarantee sovereignty.

China itself appears to be acknowledging this. Beijing is considering restrictions on foreign access to its most advanced AI models, in order to treat these technologies as strategic assets. Chinese openness is therefore part of a strategy of catching up, exerting influence and establishing a foothold, and Beijing may decide to close access once its best models become too valuable to circulate freely, just as the United States has done. China opens up to conquer, then may close down to retain its advantage.

Europe must not choose between two illusions: believing that a closed American model will remain available because it is commercially distributed, or that an open Chinese model becomes sovereign simply because it can run locally. Anthropic and Alibaba demonstrate that AI models concentrate intellectual property, biases, technical dependencies, legal constraints and state interests. Sovereignty begins when control extends simultaneously to the infrastructure, the data, the models, their access conditions and the biases they incorporate. We are a long way from achieving this.