Report's allegations about Alibaba-related distillation activity: GTG-16005 case

What happened

An operator linked to Alibaba ran the largest distillation attack we have measured. This illicit distillation activity targeted the chain-of-thought (CoT) reasoning records of Opus 4.6 and 4.7.

Alibaba's CoT distillation pipeline injected a fixed prompt into each request, forcing Claude to write its reasoning trace within inline text tags before providing the final answer. These CoT records were then saved and converted into data usable for supervised fine-tuning (SFT). These SFT records were used to help train Alibaba's Qwen models and were used to distill Claude's capabilities into Qwen 3.5, 3.6, and 3.7.

Alibaba's illicit distillation activity peaked at nearly 3 million interactions per day from more than 3,500 fraudulent accounts. The distillation attack targeted agent tasks, software engineering, kernel development, and long-cycle tasks. The collected records were used to improve the reasoning capabilities of Alibaba's models.

In addition to distillation, Alibaba also used Claude to advance its AI R&D work. Alibaba used Claude to help develop the internal infrastructure for its model development. Claude was used to help develop Alibaba's reinforcement learning (RL) environment and advance model architecture research.

Alibaba accessed Claude through two main pools of fraudulent accounts. The first pool consisted of nearly 5,000 fraudulent accounts, using residential proxies, disposable email addresses, and virtual card payments to mask its access. When we banned this account pool, Alibaba quickly shifted its traffic to a second pool. Some of these accounts were found to simultaneously forward requests from DeepSeek and Xiaomi, indicating that the same proxy service network is often used by various organizations.

The scale of the distillation attack attributed to Alibaba between May and July 2026: more than 151 million interactions observed.

What AI did in this case

In this allegation, Claude played two roles: first, as the object of extraction — its reasoning records were collected at scale to be used as training material for another model; second, as an R&D assistant — the report says Claude was used to help build the internal infrastructure for model development.

The report says the distillation attack targeted Claude's capabilities in agent tasks, software engineering, kernel development, and long-cycle tasks.

What the report observed

The report says Alibaba accessed Claude through two main pools of fraudulent accounts: the first pool contained nearly 5,000 accounts, which the report says used residential proxies, disposable email addresses, and virtual card payments to mask the source of access; when Anthropic banned the first pool, traffic quickly shifted to the second pool.

The report also says some of these accounts were found to simultaneously forward requests from DeepSeek and Xiaomi, from which the report concludes that the same proxy service network is often shared by multiple organizations. Between May and July 2026, the report attributes more than 151 million interactions to Alibaba's distillation attack.

Confirmed & unknown

Platform response

Anthropic says it has banned the relevant accounts and deployed measures to detect and disrupt future abuse.

Limits of response：Banning accounts cannot recover the reasoning records already extracted; the report does not state whether the relevant models have already completed training using these records.