Alibaba's Claude Ban Explained: The Full Story Behind the US-China AI Distillation War

How It Started: Alibaba Bans All Anthropic Products Internally

According to Tech24, the technology program from French media outlet France 24, Alibaba officially banned employees from using Claude Code starting July 10 — one of the most popular AI coding assistants globally, including in the Chinese market. Chinese media reports suggest the ban goes even further: Alibaba employees are prohibited from using any Anthropic products and must instead use Alibaba's own coding tool, Coda.

This is not an isolated incident. It's the latest — and most telling — escalation in a weeks-long friction between two of the world's biggest tech giants. On the surface, it looks like an internal tool switch. Beneath it lies a tangle of model distillation, copyright disputes, and national security narratives.

The Trigger: Anthropic Accuses Alibaba of "Largest-Ever Distillation Attack" on Claude

The conflict began with a letter. Several weeks ago, Anthropic wrote to two US senators, characterizing Alibaba's actions as "the largest-ever model distillation attack against Claude."

What Is Model Distillation?

Model distillation refers to using a powerful large model as a "teacher model" — flooding it with massive amounts of questions, collecting its responses, and then using that high-quality Q&A data to train a model you're developing yourself. This approach avoids the complexity and cost of full training from scratch, making it a low-cost shortcut to building high-performance models.

The technique was originally proposed by Geoffrey Hinton and others in 2015 as a model compression method — transferring "knowledge" from large neural networks into smaller ones for deployment on compute-constrained devices. The core idea is to use the teacher model's "soft labels" (probability distributions across categories, rather than simple 0/1 hard labels) to supervise student model training, conveying richer semantic information.

In the era of large language models, the meaning of distillation has expanded significantly. A "distillation attack" now specifically refers to systematically sending carefully crafted prompts to a target model, collecting its outputs as training data, and reverse-engineering the model's capabilities and reasoning style. The cost advantage is enormous — pretraining a top-tier LLM requires hundreds of millions to billions of dollars in compute, while distillation can compress that cost by orders of magnitude. Meta's LLaMA series, Stanford's Alpaca model, and several domestic Chinese open-source models have all been noted by researchers to show varying degrees of distillation influence — which is why this technique has long existed in a gray zone within the AI industry.

Distilling a model against your own internal models is legal and widely practiced. What Anthropic objects to is competitors applying this method to its own models. According to Anthropic's disclosure, this distillation campaign lasted approximately six weeks, involved roughly 25,000 fake accounts, and spanned nearly 29 million individual conversations — a scale that is genuinely staggering.

The Plot Twist: Anthropic Itself Trained Claude on Pirated Data

The most ironic moment in this whole affair, however, is the counterargument.

Claude's training data encompasses nearly the entire internet, along with vast quantities of books — many of which came from pirated sources. Anthropic paid a settlement of up to $1.5 billion over this. The final ruling in that case carried significant implications for the entire AI industry: training on pirated content qualifies as fair use, but obtaining pirated content in the first place remains illegal.

"Fair use" is the exception principle established under Section 107 of US copyright law, permitting unauthorized use of copyrighted works under specific conditions, evaluated across four dimensions: purpose of use (whether transformative), nature of the work, amount used, and market impact. Classifying AI training as fair use is the prevailing tendency of US courts handling such cases — the core logic being "transformative use": models don't copy original text, but extract statistical patterns from it, creating a new form of value.

However, this ruling does not mean that obtaining pirated content is itself legal. Anthropic, OpenAI, Stability AI, and others have all faced or are facing similar lawsuits, with the key distinction being: training on legally obtained copyrighted content versus first obtaining it illegally and then training on it are two very different things in law.

For this reason, Anthropic did not center its accusations against Alibaba on "copying" per se, but instead emphasized that this violated its terms of service — competitors are not permitted to perform such operations on Claude. This legal strategy is deliberate: breach of terms of service is far clearer to prove and apply than fighting on the still-murky terrain of copyright boundaries. The more significant move was Anthropic escalating this dispute from a commercial conflict into a US national security issue.

From Business Dispute to National Security: A Narrative Escalation

Anthropic warned senators that distillation poses safety risks — when adversaries copy a model's capabilities, they strip away all safety guardrails in the process, producing a "zero-guardrail" model that could theoretically be used to develop weapons.

This concern does have a technical basis in AI safety research: student models obtained through distillation tend to inherit the teacher model's capabilities without replicating the safety alignment mechanisms instilled through methods like RLHF (Reinforcement Learning from Human Feedback). This means a model distilled from Claude might have considerable code generation or scientific reasoning ability while lacking the ability to refuse harmful requests.

Framing this as a national security narrative echoes the policy context of the US Commerce Department's continuously expanding chip export controls toward China since 2022 — grounded in the same premise of "dual-use technology" security risks.

Critics point out, however, that this logic applies equally to any open-source model — Llama, Mistral, and other models with publicly available weights can similarly be "de-guardrailed." Singling out distillation as a unique national security threat carries an obvious selectivity. Setting aside the longstanding debate over open-source versus closed-source models, it's clear that Anthropic has skillfully repackaged a commercial dispute as a national security threat — more useful as lobbying ammunition than as rigorous security analysis. This narrative escalation strategy is itself a repeatedly seen tactical move in the US-China AI competition.

Alibaba Strikes Back: Claude Code's Hidden Tracking Mechanism

Alibaba's ban on Claude was not without a specific grievance — it seized on another critical finding.

A Reddit developer recently discovered that multiple versions of Claude Code have a sophisticated identification mechanism built in, allowing Anthropic to determine where a user's connection originates. The system prompts contain differences nearly invisible to the human eye: the apostrophe on the third line actually uses three different Unicode characters, and the date line's separator varies between slashes and hyphens.

System prompts are a critical component of LLM application architecture — they appear before the user conversation, pre-injected by the developer to set the model's role, behavioral boundaries, and contextual constraints. The differences discovered by researchers — distinct Unicode apostrophe characters (such as U+2019 right single quotation mark versus U+0027 standard apostrophe), subtle date separator variations — represent a form of soft fingerprinting based on invisible differences. This approach has precedents in copyright protection: publishers have long planted subtle spelling variations in books to trace leaks, a technique historically known as the "Canary Trap." Using such mechanisms for geographic inference is technically straightforward — API endpoints or proxy configurations in different regions carry specific request headers that, combined with timezone metadata, enable reasonably accurate source identification.

These subtle differences are linked to the user's timezone. Once a Chinese timezone, a Chinese domain name, or a domain indicating the user belongs to a Chinese AI company is detected, the corresponding identification logic is triggered.

The discoverer labeled it "spyware," but that characterization is an overstatement. The mechanism more closely resembles geo-fencing technology commonly used by websites, implemented at the system prompt layer rather than the network layer. For a company desperately trying to curb abuse of Claude within China, building in location-detection is not unusual. Nevertheless, Alibaba used this discovery to construct its official narrative for banning Claude: enterprises don't want their geographic location quietly assessed without employees' knowledge.

Can Banning Claude Stop Distillation Attacks?

The answer is: no.

Distillation attacks rely on thousands of proxy servers and fake accounts — they are organized campaigns lasting weeks, entirely distinct from employees' individual daily use of AI tools. Banning Claude Code neither terminates distillation that has already occurred nor meaningfully blocks potential future operations. The more realistic scenario: even Alibaba employees will likely continue accessing these tools via VPNs and similar means.

Ultimately, this entire sequence of events is part of the larger US-China AI competition — reflecting the tactics both sides employ to gain an edge in the technology race: technical accusations, narrative packaging, internal bans, and playing the national security card. Each move is a footnote in this great tech rivalry.

Conclusion

Alibaba bans Anthropic tools; Anthropic accuses Alibaba of large-scale distillation. Both sides expose each other's cards, presenting a rather ironic picture: the party accusing the other of "copying" itself trained on pirated data. There is no absolute moral high ground in this dispute — it is largely a head-on collision driven by commercial interests and geopolitical entanglement.

For developers and enterprises caught in the middle, finding the right balance between compliance, security, and efficiency will remain a long-standing challenge without easy answers.

Key Takeaways