China just pulled off the biggest AI heist in history on Anthropic. In a letter sent to the Senate Banking Committee, Anthropic accused operators tied to Alibaba's Qwen AI lab of running the largest model extraction attack the company has ever detected. The numbers are truly insane: Alibaba allegedly used roughly 25,000 fraudulent Claude accounts to generate 28.8 million queries over a 44 day operation that ran from April 22 to June 5, all aimed directly at Claude's two most commercially valuable skills - advanced software engineering and agentic reasoning (the ability to plan and execute multi step tasks on its own). For context, this SINGLE campaign was larger than every previous Chinese campaign against Claude COMBINED. The technique is called distillation. You point a cheaper model at a stronger one, pump millions of carefully crafted prompts through it, harvest the answers, and then train your own model on the responses. The attacker never sees the weights, never touches the training data, and never has to actually break in anywhere. The attacker just has to be a paying customer. This is the new playbook for corporate espionage in AI. Competitors do not have to hack the company they want to copy. They sign up for the API like everyone else, route tens of millions of queries through proxies and stolen identities, and walk away with a working clone of the most valuable capabilities. And here is where it gets darker... In April, the White House published a formal memo through OSTP director Michael Kratsios identifying distillation as a national security threat and committing to share intelligence with American AI labs about foreign campaigns. Anthropic says the Alibaba campaign started AFTER that memo was published. In open defiance of the administration's warning. Then two days after Anthropic sent its private warning to the Senate, the Commerce Department's response landed: They did NOT sanction Alibaba. They restricted Anthropic's most advanced models from American customers worldwide, citing national security concerns. So the actual timeline reads like this: Alibaba allegedly extracts billions of dollars of American AI capability over six weeks. Anthropic warns Washington. Washington responds by locking American companies out of the very models Alibaba allegedly already copied. Alibaba's American depositary receipts dropped more than 3% on the news and fell below $100. The company is also suing the Pentagon to be removed from the Chinese military blacklist it was added to on June 8. Anthropic is now fighting on two fronts at the same time. The first front is trying to convince Washington to protect its models from being stolen abroad. The second is trying to convince Washington to let Americans actually use those models at home. If your competitive moat is model capability, your moat is a leaky API key. Every API you consume is a potential extraction surface, and every API you sell is a potential extraction target. The intellectual property border simply does not exist when the product ships as software through a public endpoint. The defensible asset is no longer the model. It is the distribution, the proprietary data pipeline, and the customer relationships that make a competitor's copy useless even when they hold it in their hands. Alibaba may already have 28.8 million pages of Claude's reasoning sitting in a training corpus right now. While American companies just got locked out of the original. Who do you think wins from that?