Anthropic Says Alibaba Used Claude 151 Million Times in Huge Qwen Training Campaign

Anthropic has accused operators affiliated with Chinese technology giant Alibaba of generating more than 151 million exchanges with Claude in what it describes as the largest unauthorised AI distillation campaign it has ever measured.

The allegation is significant because Anthropic claims those exchanges were used to help improve Alibaba’s Qwen artificial intelligence models, although Alibaba had not publicly responded to the specific claims when Reuters reported them.

Alibaba is one of China’s biggest technology companies, while Qwen is its family of AI models and a major competitor to systems developed by American companies including Anthropic and OpenAI. Before the scale of the allegation makes sense, however, it helps to understand what distillation actually means and why AI companies use it.

Model distillation is a legitimate and widely used training technique where a more capable AI acts a little like a teacher for another model. Developers can collect large numbers of responses from the stronger system and use those examples to help a smaller or less capable model learn similar behaviours without repeating every part of the enormously expensive original training process.

Anthropic is not arguing that distillation itself is automatically wrong. Its allegation is that operators linked to Alibaba secretly accessed Claude at industrial scale, deliberately disguised that access and extracted valuable reasoning from Anthropic’s models without permission.

According to Anthropic’s September threat intelligence report, the campaign targeted the reasoning produced by Claude Opus 4.6 and 4.7. Anthropic says prompts were inserted into requests that encouraged Claude to write out detailed reasoning, which was then saved and converted into data suitable for supervised fine tuning of Qwen 3.5, Qwen 3.6 and Qwen 3.7.

Supervised fine tuning is another standard AI training technique, where a model is repeatedly shown examples of the kind of response developers want it to produce. The controversial part here is therefore not the training method itself, but Anthropic’s claim about where the training material came from and how it was obtained.

The numbers are what turn the allegation into such a major industry story. Anthropic says activity peaked at almost three million exchanges in a single day and involved more than 3,500 allegedly fraudulent accounts during periods of intense activity.

Anthropic says the first major account pool contained nearly 5,000 accounts using residential internet proxies, disposable email addresses and virtual payment cards to disguise where the traffic originated. When Anthropic banned that group, the company says the activity rapidly moved to a second pool of accounts rather than stopping.

The alleged campaign was not limited to asking Claude ordinary questions either. Anthropic says the material targeted areas including software engineering, agentic tasks, computer kernel development and long running problems, while Claude was also used to help with Alibaba’s reinforcement learning environments and wider research into model architecture.

Why is that important? Training a frontier AI model can require enormous spending on specialised chips, data centres, electricity, researchers and months of computing time, so the behaviour of a successful finished model becomes commercially valuable in its own right.

If another company can question that finished model millions of times and transfer even part of what it learns into a rival system, it could potentially acquire capabilities much more cheaply than developing them independently. That does not mean 151 million conversations would create a perfect copy of Claude, but they could still provide valuable examples of how a highly capable system approaches difficult tasks.

There is also a much wider geopolitical argument developing around this. Reuters reported that the US government has separately accused Alibaba and other Chinese AI companies of industrial scale efforts to copy American AI technology through distillation, while China rejected those wider accusations and described distillation as a neutral technique used throughout the industry.

That makes attribution particularly important in this article. The 151 million figure and the claim that Claude outputs helped train specific Qwen models come from Anthropic, and until Alibaba responds or independent evidence confirms the internal training process, they should remain presented as allegations rather than established fact.

Anthropic says it is strengthening systems designed to identify suspicious account networks and prevent extraction of detailed reasoning. The company's report also suggests this will become an increasingly difficult technical battle as operators switch accounts and access routes whenever one method is blocked.

The argument now goes far beyond whether one company asked another company’s AI too many questions. As models become worth billions to build, the industry is heading towards a much bigger fight over where legitimate learning ends and unauthorised extraction begins.