Actuia Alibaba's Qwen Lab Linked to Major Claude Distillation Campaign
Article Content
- •Alibaba's Qwen lab used 25,000 fake accounts for 29 million Claude exchanges.
- •This campaign is the largest distillation effort reported, surpassing previous attacks.
- •U.S. lawmakers are considering sanctions against Chinese firms involved in AI model exploitation.
On October 19, 2026, Anthropic reported to Congress that Alibaba's Qwen lab executed a significant distillation campaign involving nearly 25,000 fake accounts, generating approximately 29 million exchanges with Claude between April and June 2026. This operation reportedly surpassed the combined activity of previous distillation efforts by DeepSeek, MiniMax, and Moonshot AI, which had collectively produced over 16 million exchanges. The U.S. government has flagged distillation as a national security concern, with proposed legislation to sanction Chinese firms involved in unauthorized access to AI model outputs. The scale of the Alibaba-linked campaign raises alarms about the potential misuse of AI technologies and the implications for U.S. AI labs. Market reactions included a drop in Alibaba's American depositary receipts following the news. Anthropic's ongoing efforts to protect Claude from such attacks include new defenses against distillation, although they admit they have not fully achieved their goals.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Alibaba in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What is the scale of the Alibaba distillation campaign?
What actions are being considered against Alibaba?
How effective are Anthropic's new defenses?
Continue Reading
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…
Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating…