Lawmakers Confront the Reckoning on China’s AI Distillation

US AI company Anthropic told senators that Chinese tech giant Alibaba ran the largest Claude distillation attack yet, with operators using roughly 25,000 fraudulent accounts to log 28.8 million exchanges with its models between April 22 and June 5. The allegation, sent in a June 10 letter to the Senate Banking Committee and made public on June 24, has landed at a Congressional hearing on the Chinese Communist Party’s campaign to acquire American AI.

At Thursday’s hearing, Republicans pressed for harder action against Beijing and Democrats warned that a sweeping response could punish Chinese Americans. The hearing also exposed the export-control pressure already pressing on Anthropic, after the Trump administration ordered the company to suspend foreign access to its newest Claude models earlier this month.

Anthropic’s Letter Names the Largest Distillation Attack Yet

Anthropic’s June 10 letter to Senate Banking Committee chair Tim Scott and ranking member Elizabeth Warren alleged that operators affiliated with Alibaba and its Qwen AI lab carried out the largest known distillation attack on Anthropic to date. The campaign ran from April 22 to June 5 and used roughly 25,000 fraudulent accounts to log 28.8 million exchanges with Anthropic’s models, the letter said. A spokesperson for Alibaba did not respond to a request for comment on the allegation. Bloomberg was first to report the letter, which was obtained by CNBC.

The campaign targeted Claude’s most valuable capabilities, including software engineering, advanced reasoning and long-duration task management. Anthropic argued that the operation was intended to accelerate Alibaba’s Qwen models while bypassing the research and development costs American labs had paid to build their systems. In February, Anthropic had publicly identified three earlier industrial-scale distillation campaigns run by DeepSeek, Moonshot AI and MiniMax.

Anthropic said in a statement that combating illicit distillation ‘requires coordinated action between government and industry’ and that it would continue working with lawmakers and the administration. The letter landed two months after the White House Office of Science and Technology Policy issued a memorandum pledging to help AI companies detect and coordinate against industrial-scale distillation. Anthropic wrote that Alibaba ‘ignored the Trump Administration’s warnings’ by pressing ahead with the alleged campaign.

How a Distillation Attack Actually Pulls Apart a Model

Distillation is a legitimate technique when done with permission. A small model can be trained on the outputs of a larger, more capable model, capturing enough of its behavior to run at a fraction of the cost. Anthropic’s accusation is that the Alibaba-linked operators ran this process against Claude without consent, at a scale and with a sophistication the company calls illicit. Distillation attacks let developers recreate similar capabilities at much lower cost, according to testimony at Thursday’s hearing by former Acting Defense Intelligence Agency director David Shedd.

The mechanics are straightforward. Operators build a fleet of fake accounts, send prompts to a target model, capture the answers, and use those answers as training data for a smaller model. The flood of requests is the tell. Anthropic’s letter describes 25,000 fraudulent accounts generating 28.8 million exchanges, a volume no individual user could produce. The result is a clone trained on stolen outputs, marketed at a price the original lab cannot match.

The White House’s April distillation memorandum warned that the same technique can be used to shortcut safety testing by replicating a model’s behavior without replicating its guardrails. Critics have argued the technique is harder to police than model-weight theft because it leaves no obvious fingerprint on the targeted lab. Anthropic’s letter is the first time a US AI lab has publicly identified a specific Chinese counterpart it accuses of running the attack.

The other side of the equation is what gets stolen: capabilities, not weights. When developers use distillation to recreate a model’s outputs, they don’t get the underlying training or safety work. The Chinese firms Anthropic named have not been accused of stealing model weights; they are accused of replicating behavior. That distinction matters for export-control design, because weight theft can be policed through chip controls and code escrow, while distillation lives in API traffic.

1. Operators create thousands of fraudulent accounts at the target lab’s API.
2. They send a flood of prompts covering the lab’s most valuable capabilities.
3. They capture the model’s outputs and use them as training data for a smaller model.
4. They release the smaller model at a lower price, undercutting the lab that funded the original research.

Inside the House Hearing on China’s AI Campaign

The House Select Committee on the Chinese Communist Party convened on Thursday to take testimony on China’s economic espionage and subnational influence in the United States. The committee’s chair, Republican John Moolenaar of Michigan, opened by describing what he called an ‘epic campaign to undermine the United States here at home’ through economic espionage, cyber intrusions and covert lobbying. Former Acting Defense Intelligence Agency director David Shedd told lawmakers that the campaign ‘blends cyber espionage, human intelligence, academic collaboration, and commercial investments,’ per Shedd’s written statement to the House committee.

Shedd told the committee that Chinese intelligence agencies target companies, universities and researchers working in artificial intelligence, telecommunications, biotechnology, quantum computing and advanced weapons systems. He said the Chinese military is ‘first in line to benefit’ from stolen AI technologies. Shedd argued that distillation attacks let Chinese firms ‘bypass the investment’ that large US AI companies have made and potentially ‘leapfrog’ years of research and development.

When asked what Congress could do immediately, Shedd pointed to TikTok and said enforcing existing legislation affecting the platform would raise the cost of Chinese influence operations while limiting access to user data. He also urged stronger protection of what he called America’s technological ‘crown jewels’ and called for closer cooperation between government and industry. The hearing’s framing set up a second front beyond AI: the response to Beijing’s espionage push itself. Moolenaar pointed to state legislatures, municipal governments and public universities as ‘soft targets’ for influence operations, mirroring the broader scope of the threat. He framed Beijing’s reach as targeting everything from community associations to land purchases near military bases.

Two witnesses joined Shedd at the table. Michael Lucci, founder and chief executive of State Armor, described US states as the ‘front lines’ of strategic competition with China and cited concerns about land purchases near military installations, influence operations targeting state legislatures and cyber threats against local governments. John C Yang, president and executive director of Asian Americans Advancing Justice, agreed that national security concerns were real but urged lawmakers to pursue evidence-based enforcement instead of policies linked to ethnicity. The hearing also drew on submissions from US AI companies beyond Anthropic; OpenAI’s February submission on the AI stakes framed the threat as a contest over frontier capability.

The hearing came against a backdrop of delicate diplomacy. President Trump and Chinese President Xi Jinping held a summit last month aimed at stabilizing relations, even as the two governments have tightened export controls in both directions. The committee’s choice of AI as the week’s hearing topic signaled that the economic espionage agenda had not been tabled by the diplomacy, and that distillation attacks are now the test case for any new enforcement regime.

The Civil Rights Fault Line the Hearing Exposed

Khanna’s sharpest exchange came with Lucci. The congressman pressed the State Armor founder on past social media posts calling for the denaturalization of Chinese Americans who obtained US citizenship through birthright. ‘Do you believe these people should be denaturalized?’ Khanna asked. ‘It’s US law that anyone born in a US territory is an American citizen. Do you believe that 1.5 million [people] should be denaturalized?’ Lucci replied: ‘I think that if they have practically zero nexus to the United States of America, other than they were born in a territory, I think it’s worth considering that, yes,’ per Khanna’s exchange with Lucci on denaturalization.

Yang took a different tack. He told the committee that the United States can confront Chinese espionage while protecting the rights of Chinese American researchers, students and faculty who contribute to American scientific leadership. He recommended stronger conflict-of-interest disclosure requirements, better university guidance on sensitive research areas and improved law enforcement training to distinguish legitimate collaboration from genuine national security threats. Yang also pushed immigration reform, telling the committee that making it easier for Chinese students to become citizens would reduce their vulnerability to ‘transnational repression.’ Yang framed the choice as one between a more effective response and a more sweeping one, telling lawmakers that ‘a targeted approach is not necessarily a softer approach. Rather, it is a more effective one.’

The exchange underscored the policy fault line the hearing opened. Republican members framed the threat as one of intellectual property theft demanding tougher enforcement. Democratic members, joined by Yang and by Gisela Perez Kusakawa, executive director of the Asian American Scholar Forum, warned that broad categorizations could drive out the talent that built American AI in the first place.

We should use a scalpel, not a sledgehammer, and not engage in broad categorizations, but engage in that type of nuance that is necessary.

John C Yang, president and executive director of Asian Americans Advancing Justice, in his testimony before the House Select Committee on the Chinese Communist Party.

The Export Control Knife Already Drawn

Anthropic is already operating under an export-control directive. Earlier this month, the Trump administration ordered the company to suspend access to its newest Claude models, Fable 5 and Mythos 5, for any foreign national, whether inside or outside the United States, including foreign national Anthropic employees. The company said the directive cited ‘national security authorities’ without specifying the concern. Senior staff flew to Washington to negotiate, and Anthropic told CNBC that ‘both parties are working quickly to get this resolved.’

The export-control order arrived without public explanation, but its timing has been read as a response to the broader theft campaign. The directive pulled the latest Claude models from foreign access ahead of the letter’s public release on June 24. The earlier public reporting on the letter and the Fable 5 block tracked the sequence as it unfolded. The White House’s April distillation memorandum had already framed industrial-scale distillation as a national security problem that AI companies, cloud providers and the government would need to address together. The directive turns that framing into an operational constraint on a single company, at least until a resolution is announced. The unresolved status of Fable 5 and Mythos 5 left Anthropic negotiating the terms under which its newest models can reach customers at all.

Why the Talent Question Is the Rest of the Story

The hearing made a numerical case for caution. Immigrants have founded or cofounded 59% of America’s privately held billion-dollar companies, according to figures cited at the hearing by the Asian American Scholar Forum. Nearly one in four of those companies was started by someone who first came here as an international student. Perez Kusakawa, the forum’s executive director, told the committee that ‘protecting researchers from discrimination and protecting our innovation edge are not competing goals but the same goal.’

Khanna and the committee’s Democrats, including Kathy Castor, André Carson, Jill Tokuda and Greg Stanton, kept returning to that framing. Their questions pushed the witnesses on whether scaling back the Office of the Director of National Intelligence’s Foreign Malign Influence Center, or pursuing broad-brush investigations of researchers of Chinese descent, would weaken the United States’ ability to detect threats or simply push the talent that built American AI to other countries. Shedd conceded that scaling back the Foreign Malign Influence Center was ‘a mistake’ but also said that non-Chinese actors, including former CIA staff, had spied for Beijing.

The open question for the committee is whether the policy response can target specific Chinese government operations without sweeping in the immigrant workforce American AI depends on. Anthropic’s distillation allegation names a Chinese counterpart and a technique. The hearing’s civil rights exchanges name a domestic political risk that the same allegation could amplify. Both pressures now sit on the same committee, and any export-control or sanctions response to Beijing’s AI campaign will be measured against Yang’s scalpel, not sledgehammer warning.