Alibaba's Distillation Attack Beat the Ban by Seven Weeks
The Distillation Problem
The timeline is the argument. Eight million exchanges with Claude, run through 25,000 fraudulent accounts, extracting model capabilities through systematic prompt distillation, a technique where an attacker queries a frontier model at scale and uses the responses to train a cheaper imitation. Anthropic, in its June 10 letter to the Senate Banking Committee, called it the largest known distillation attack it had ever faced. Seven days later, on June 12, the US government ordered Anthropic to suspend all access to Claude Fable 5 and Mythos 5 for any foreign national globally, including Anthropic's own employees, citing cybersecurity capabilities as the reason. The sequence is the problem: the capability extraction the ban was designed to prevent had already been completed, through the API, weeks before the ban existed. No chip restriction stops a distillation attack. The Bureau of Industry and Security's October 2023 controls, the Commerce Department office that manages export licensing, keep Nvidia H100s and B200s out of Chinese data centers. They have no reach over a JSON response to a well-crafted prompt. Alibaba ran its campaign through standard commercial API access, the same channel available to any enterprise customer. Anthropic's API authentication infrastructure faces a rebuild deadline the company has not named publicly. Until that deadline is set, the ban's mechanism is a closed international developer market, not a closed distillation vector.
Asymmetric Pressure, Asymmetric Exposure
Anthropic's public response to the ban was precise and worth reading carefully. Fable 5 faced controls that Fable 5's closest competitor did not. If that claim holds, the ban is not a capability restriction, it is a market restriction on one company that leaves the underlying capability available through a rival. Government officials described the next model in the pipeline as on par with Mythos, making it the first time the US government had moved to restrict a model before it launched. The pattern is clear: the software-output layer is being regulated, unevenly and under operational pressure, without a settled framework. Meanwhile, GLM-5, a 745-billion-parameter mixture-of-experts model from Zhipu AI, a Beijing-based lab spun out of Tsinghua University, was trained entirely on Huawei Ascend 910B clusters with zero US hardware dependency. Alibaba's Qwen family had surpassed Meta's Llama in cumulative HuggingFace downloads by April 2026. The researchers outside the US who held Fable 5 access on June 11 lost it on June 12. GLM-5 and Qwen did not.
The Jalapeño inference chip that OpenAI and Broadcom unveiled on June 24, taped out in nine months, purpose-built for inference at scale, runs behind proprietary silicon the API surface cannot replicate. The Senate Banking Committee markup falls later this summer. Before that vote, the committee has not answered whether software-output controls push the industry toward closed deployment or simply fracture research access while the distillation channel stays open. Alibaba completed its extraction by June 5. The ban arrived June 12.