Washington’s AI Distillation Warning: What the

Anthropic says Alibaba used 25,000 fake accounts to pull 28.8 million exchanges out of Claude between April and June 2026, according to Tom's Hardware. That single claim sits at the center of a much bigger fight: US officials are now accusing Chinese AI companies of systematically using distillation to extract capabilities from American models, and the accusations have escalated from a lab-by-lab grievance into something approaching a formal government warning. CyberScoop frames it exactly that way: a dispute over whether distillation crossed into unauthorized appropriation, and over how anyone could prove it.

I run a distillation experiment every time I test a mid-tier model on a budget. You pick a frontier model, fire off a few thousand prompts through the API, save the outputs, fine-tune something cheaper on them, and you've got a little sibling that talks like the big one. I've done versions of this on my lunch break with open-source tooling. If you hold an API key, so could you. That's the whole problem in one paragraph: the technique is a few hundred dollars of API calls and a training run away from anyone, and it's indistinguishable from ordinary usage at the traffic level.

Why Distillation is Both Normal and Contested

Distillation is a bedrock machine learning technique. A smaller or cheaper model learns from the outputs of a larger one. Everyone from university labs to startups uses it, and nobody in this dispute is arguing the technique itself is illegitimate. The disagreement is about consent. If you distill from a model you licensed, or from an open-weights release, you're inside the rules. If you spin up fake accounts, violate terms of service at scale, and harvest a competitor's outputs to train a rival product, you're doing something the model owner will call theft.

That's the case Anthropic laid out against Alibaba. The 25,000 accounts and 28.8 million exchanges, allegedly active from April through June 2026, represent what Anthropic characterizes as an industrial-scale copying campaign, and Engadget reports US authorities now describe similar campaigns across multiple Chinese companies. The Register goes further, saying Washington claims distillation is the core strategy of Chinese AI companies, period (The Register). Slashdot picked up the "systematic" framing the same day.

We covered the earlier round of this when Anthropic first alleged roughly 24,000 fake accounts and 16 million extracted exchanges in Anthropic Accuses Chinese AI Labs of Model Distillation, so the numbers have grown since then. Treat the growth itself with care: these are the accusing party's own figures, generated by its own detection systems, and independent verification hasn't appeared yet.

What the Claims Do and Don't Prove

If you poke at those figures, the interesting part is what they imply about detection and what they can't establish. Anthropic caught the activity, which means providers can at least flag bulk abusive traffic. But catching fake accounts proves terms-of-service violations. Proving that the extracted outputs changed what a competitor's model can do is a much harder scientific claim. Model training involves enormous datasets from many sources; nobody outside the accused lab can audit what fraction of a weights file came from Claude outputs versus anything else. The attribution problem is unsolved, and any government case built on this will live or die on technical evidence that doesn't fully exist yet.

There's also an awkward definitional edge. Alibaba, like every major lab, publishes open-weight models. When a company both releases its models for anyone to download and stands accused of harvesting a rival's outputs, the line between "competing with public methods" and "stealing protected assets" gets blurry in both directions. Silicon Valley labs distill each other constantly through publicly available outputs; the objection is really about scale, deception, and terms violations, not the learning technique.

The Historical Rhyme

Desk note from someone who's read too many tech-history threads: the United States has been on the copying side of this story before. In the 1970s and 80s, American firms accused Japan of systematically appropriating US semiconductor and consumer electronics technology; Washington responded with export controls, trade complaints, and a lot of rhetoric about unfair competition. Some of those accusations had merit, some were protectionism dressed as principle, and over the following decades Japan built genuine independent leadership in chips, sensors, and cameras. The lesson isn't "this always happens and it doesn't matter." It's that accusations of systematic copying tend to arrive right when the accused party gets good enough to be scary, and the policy response shapes an industry for decades. Skip the history and you misread the stakes.

The Wrong Threat, Say the Skeptics

Not everyone in Washington is convinced copying is even the problem worth this much attention. According to Fast Company, experts argue the White House fixation on China copying US AI targets the wrong threat. The strongest version of that argument: frontier capability comes from compute, data pipelines, and research talent, and a distillation run captures outputs, not the machine that made them. The gap regenerates faster than it can be copied.

US policy may already have backfired in a related way. Alvin Graylin argues, in US Chip Embargo on China: What Went Wrong, that chip export controls mostly accelerated China's domestic GPU industry while training simply moved offshore. That's Graylin's argument, not desk consensus, and the record on it is still being written. But it pairs uncomfortably with the current warning: if the tools Washington can actually deploy are chips and infrastructure, and those tools can't stop one model from teaching another through an API, the policy response to distillation has to be something new, and nobody has specified what.

Export controls also sit oddly next to the open-source fault line. Moonshot's Kimi K3 release split the industry over whether Chinese open weights are a gift or a trap, which we dug into in Kimi K3 and the Silicon Valley Split on Chinese AI, and the same tension fractures the administration itself, as covered in China's AI Models Are Splitting Washington in Two. You can't simultaneously celebrate open-weights competition and treat every downstream capability as stolen.

The Feedback Loop Risk

The wider risk runs the other way from tighter enforcement. The industry runs on shared methods, published research, and open benchmarks. If every query becomes a suspected extraction event, the rational response for every lab is rate limits, identity verification, refused access, and closed research. Reciprocal accusations, on both sides, make openness look naive. Gizmodo's reporting on AI agents serving cybercriminals shows where permissive access already goes (Gizmodo), so the impulse to lock down isn't paranoia; it's a reasonable reaction to a real abuse surface.

The question nobody has answered: what does a rule that distinguishes legitimate distillation from theft look like in practice? A student fine-tuning on a public API is fine. A competitor doing it through 25,000 fake accounts is not. The space between those two sentences is where the next few years of AI policy, litigation, and probably some very expensive court cases will live. My API bill will be there too.

Tyler Nakamura covers consumer tech and gadgets for Buzzrag.