Artificial intelligence is entering a new phase of its geopolitical confrontation. After the battle over semiconductors, data centers and the latest generation chips, it is now the exploitation of the models themselves which is concentrating tensions.
According to Bloomberg, in a letter Anthropic claims that Alibaba orchestrated, between April and June 2026, a campaign based on nearly 25,000 fraudulent accounts in order to generate 28.8 million interactions with Claude. According to the American company, the objective was not to use its conversational assistant, but to methodically extract its capabilities in order to train competing models. In a letter addressed to several American senators and the White House, Anthropic describes this campaign operation as “adversarial distillation” carried out on an industrial scale.
An ancient technique that has become a subject of national security
There is nothing illegal about distillation in itself. For several years, it has been one of the classic machine learning techniques.
Its principle is simple. A large model, called the “teacher”, is used to train a second, more compact model, the “student”. This learns to reproduce the behavior of its teacher while requiring much less memory, computing power and inference costs. This approach is used across the industry to deploy models on smartphones, embedded equipment or lower-cost infrastructure.
In this context, distillation represents a perfectly legitimate optimization tool. “Adversarial distillation” is based on a radically different logic.
The laboratory that wishes to train its model no longer uses its own system as a teacher. He massively questions a competitor’s model, collects his answers, structures them then reinjects them into his own training process.
In this case, Claude would unwillingly become the teacher of a competing model.
This distinction is essential, because what Anthropic denounces is not the distillation technique itself, but its use without authorization against a proprietary model in order to reproduce part of its capabilities.
Reproduce years of research for a fraction of the cost
The economics of frontier models explains the virulence of Anthropic’s reaction.
Developing a model like Claude requires several billion euros of investment. The laboratories mobilize hundreds of thousands of GPUs, some of the most powerful computing infrastructures in the world and several months of continuous training. Added to these costs are expenses related to datasets, alignment, security assessments and research teams.
Distillation promises to significantly reduce this bill.
By querying an existing model on millions of cases, an actor can recover reasoning patterns, problem-solving strategies, alignment preferences or even specialized behaviors in areas such as programming or autonomous agents. It does not directly copy the model’s weights, but seeks to reproduce its observable behavior.
For American laboratories, this approach amounts to capturing part of the value created during training without having to make the same investments. An economic asymmetry which feeds the industry’s concerns.
Why Anthropic talks about an industrial operation
The figures put forward by Anthropic illustrate a change of scale. The company mentions nearly 25,000 fraudulent accounts having generated 28.8 million conversations in the space of three months. According to her, the requests primarily targeted Claude’s more advanced abilities, including software development and agentic reasoning.
This description moves away from simple misuse of an API. Anthropic describes an automated framework that can bypass account limitations, distribute queries across a large number of identities, and systematically collect model responses. The vocabulary used “industrial scale” compares these practices to cyberespionage campaigns or massive data collection operations.
Tennesee Republican Sen. Bill Hagerty and New Jersey Democrat Andy Kim plan to introduce an amendment to penalize companies engaging in such practices.
Where does the learning stop, where the copying begins?
The case, however, raises a legal question that is still largely open. All laboratories evaluate their competitors’ models. Public benchmarks, performance comparisons or response analyzes are common practices in artificial intelligence research.
The difficulty consists in defining the moment when an evaluation process becomes an attempt at industrial reproduction. The number of requests? Their automation? The objective pursued? The data thus constituted?
No legal framework currently clearly answers these questions, and this gray area explains why Anthropic seeks to move the debate from the contractual field to that of national security. If distillation is framed as a strategic threat rather than a simple violation of an API’s terms of use, it opens the door to economic sanctions and government intervention.
A new frontier for cybersecurity
The consequences will also be technical. Laboratories probably won’t be able to completely prevent distillation. On the other hand, they will seek to make it more difficult, more expensive and more easily detectable.
This opens a new field for cybersecurity applied to artificial intelligence.
Behavioral detection of users, dynamic limitation of requests, digital fingerprints of responses, sharing of information between laboratories and even watermarking mechanisms are all avenues already explored by major American players.
As models become more valuable, their APIs also become critical infrastructure.
