- Lead. Anthropic has disclosed that a campaign it attributes to operators linked to Alibaba’s Qwen AI lab extracted 28.8 million interactions from its Mythos model using roughly 25,000 fraudulent accounts over 45 days — what the company is describing as the largest model distillation enforcement action it has undertaken.
- Fact. The technique at issue — adversarial distillation — involves flooding an AI model’s API with queries specifically designed to capture responses that can then be used as training data to improve a rival model, without paying for or licensing the underlying capability.
- Stake. The disclosure arrives as US legislators are moving toward sanctions against entities that conduct large-scale AI model extraction; two senators have already introduced an amendment to defence legislation that would specifically target such operations.
The campaign, which Anthropic traced to operators linked to Alibaba’s Qwen team, ran from April 22 to June 5, 2026. According to Anthropic’s disclosure — reported by AI industry publication AITNT News on June 26 — approximately 25,000 accounts were created to conduct 28.8 million interactions with Anthropic’s Mythos model across the 45-day period. The harvested responses were then systematically used as training data for successive Qwen releases.
How model distillation works as an attack
Adversarial distillation exploits a fundamental dynamic in large language model deployment: a sufficiently large volume of carefully crafted queries can effectively transfer a proprietary model’s learned capabilities into a separate model trained on the captured outputs. The attacker does not need access to the model’s weights, training data or architecture — only access to the API that serves predictions. Fraudulent account creation is the standard countermeasure bypass, since usage policies and rate limits are typically enforced per-account.
Anthropic’s Mythos model sits at the frontier of its model family. As reported here when Washington ordered Anthropic to restrict access to Mythos 5 for foreign nationals, the model carries specific national security sensitivities given its advanced reasoning capabilities. Those are precisely the capabilities the Qwen team is alleged to have targeted: Anthropic identified software engineering and agentic reasoning as the primary focus of the extraction campaign.
Legislative response
Senators Bill Hagerty and Andy Kim have introduced an amendment to defence legislation that would authorise sanctions against entities found to be conducting large-scale illicit model extraction campaigns. The proposed measure would add model distillation attacks to the toolkit of economic countermeasures the United States can deploy against foreign AI labs that systematically extract proprietary AI capabilities without authorisation.
The disclosure extends a pattern of escalating legal and regulatory friction around AI intellectual property. Courts have been handling copyright claims from authors and publishers over training data, but the Anthropic-Alibaba case differs in targeting the output layer — using a model’s inferences rather than its training inputs. As state attorneys general have moved against OpenAI, the legal environment for frontier AI labs is growing more contested from multiple directions simultaneously.