The 28.8-million-query heist: distillation, not code theft, is how the frontier gets copied

Here are the claims, carefully attributed. Anthropic says operators it links to Alibaba's Qwen lab ran what it calls the largest "distillation" campaign ever measured: more than 28.8 million interactions with Claude between April 22 and June 5, 2026, using roughly 25,000 fraudulent accounts. It's not isolated — Anthropic ties an earlier February wave of ~24,000 fake accounts and 16 million interactions to operators connected to DeepSeek, Moonshot AI and MiniMax, and OpenAI sent Congress a memo accusing DeepSeek of systematic distillation. These are accusations from the incumbents, not proven findings in court, and worth flagging as such. The mechanism is simple: feed a powerful model crafted prompts, harvest its outputs, and train a smaller, cheaper model to mimic it — routed through proxy services and account networks to slip under rate limits.

The industry response is telling. OpenAI, Anthropic and Google formed the Frontier Model Forum in April to share intelligence and coordinate defenses — the same three-way alignment we've flagged before, where fierce rivals cooperate on the plumbing and the threats they all share. The detection problem is genuinely hard: distinguishing a legitimate enterprise power-user making thousands of API calls from a bot swarm deliberately distributing queries to stay invisible is not a solved problem, and rate limiting only goes so far.

Our reading: strip away the espionage framing and this is a structural fact about the technology, not just a crime story. A model that answers questions inevitably teaches whoever is listening; capability leaks through the output layer, which is the one surface a commercial API cannot close. That's why "Chinese open-weight model matches GPT/Claude" headlines deserve scrutiny — some of that convergence is real engineering, and some of it is distilled from the very frontier it claims to rival. Distillation compresses the incumbents' lead from years to months, and no amount of guardrail engineering fully stops it.

That cuts two ways, and honesty requires holding both. The democratizing force we champion — cheap, open, sovereign models — is partly powered by exactly this kind of extraction, and pretending otherwise would be dishonest. But the article's own warning is the one to watch: if Washington answers with blunt export controls, the collateral damage lands on legitimate open-infrastructure projects, not just the bad actors. We've seen this movie — controls that chase distillation risk accelerating Chinese self-reliance while taxing the open ecosystem that makes AI accessible to everyone else. The defensible moat was never the weights; it's the compute, the data pipeline, the product, and the trust. Firms that understand that will out-build the copyists. Firms that lobby for a wall will find the wall mostly keeps their own customers in.