“These distillation attacks turn hundreds of billions of dollars in American investment and R&D into a massive subsidy for our geopolitical competitors.” That sentence is from Anthropic’s letter to the US Senate Banking Committee, sent June 10 2026 and made public this week. It is also the most precise single-sentence description of what happened. Alibaba sent Claude 28.8 million questions. Claude answered them. Alibaba used those answers to train Qwen. American investors paid for the R&D that produced Claude. The Chinese government, Anthropic alleges, got the benefit.”
Ground Truth · Episode 16 · June 29 2026Between April 22 and June 5 2026, something was happening inside Claude’s API that Anthropic did not immediately detect. Approximately 25,000 accounts — fraudulent, coordinated, operated by parties Anthropic alleges were affiliated with Alibaba and its Qwen AI lab — were sending Claude carefully designed prompts and collecting every response. Over six weeks, those accounts generated 28.8 million exchanges. The technical term for what they were doing is distillation: training your own AI model on the outputs of a competitor’s model, using those outputs as the teacher signal that shapes your model’s behaviour. No passwords were stolen. No firewalls were breached. The attackers used Claude exactly as any ordinary user would. They just used it 28.8 million times through 25,000 accounts, targeting very specifically the capabilities where Claude Mythos Preview excels: agentic reasoning, software engineering proficiency, and long-horizon task completion. On June 10th, Anthropic sent a letter to US Senate Banking Committee Chairman Tim Scott and Ranking Member Elizabeth Warren documenting the attack and requesting that Congress act to criminalise it. The letter became public on June 25th. Welcome to Episode 16 of Ground Truth.
The Attack That Requires No Hacking and Produces Real Capability
Distillation is a legitimate AI training technique — and a powerful one. The conceptual foundation: a large, capable “teacher” model produces outputs that encode its learned behaviour. A smaller “student” model is trained to reproduce those outputs. The student learns, in effect, by reading the teacher’s answers — developing capabilities faster and more efficiently than it could by training on raw data alone, because the teacher has already done the work of extracting the relevant signal from the training corpus. This technique is used legitimately by every major AI lab in the world, including Anthropic, to train smaller, more efficient models from larger ones within their own model families.
The Alibaba attack is the same technique applied externally — training on a competitor’s model outputs rather than your own. The specific capabilities targeted — agentic reasoning, software engineering, and long-horizon task completion — are not randomly chosen. They are precisely the capabilities where Claude Mythos Preview leads the benchmark tables and where the training cost to develop them independently is highest. Claude Opus 4.8 regained the number one coding benchmark position with its May 28th release. Claude Code weekly active users in Korea grew 6x in four months. These are the specific capabilities that Alibaba, on Anthropic’s account, was attempting to acquire without paying for the R&D that produced them.
The legal status of distillation attacks is, as the letter acknowledges, ambiguous under current law. Using an AI system’s outputs to train a competing model is not clearly illegal under any existing US statute. It may violate terms of service — Anthropic’s terms of service prohibit using Claude’s outputs to train competing AI models — but terms of service violations are civil matters and the enforcement mechanisms are limited, particularly against actors operating across international jurisdictions. Anthropic is asking Congress to criminalise systematic distillation attacks. The letter’s framing — “turning American R&D into a subsidy for geopolitical competitors” — is designed to make this a national security argument, not merely an intellectual property argument, because the national security framing is what moves legislation in the current Congress.
Duration: April 22 — June 5 2026. Six weeks. Accounts: approximately 25,000 fraudulent accounts. Exchanges: 28.8 million conversations with Claude. Targeted capabilities: agentic reasoning, software engineering proficiency, long-horizon task performance. Detection: Anthropic identified the pattern. Date White House was warned: April 2026 (via memo to foreign entities). Attack status after warning: continued. Date Fable 5 was recalled: June 12 2026. Date SK Telecom access was revoked: pre-June 12 (connection to Alibaba attack: not confirmed but circumstantially proximate). Date Anthropic sent Senate letter: June 10 2026. Date letter became public: June 25 2026. Current legal status of distillation attacks: ambiguous. Current Fable 5 status: offline, day 14, zero traffic confirmed by Anthropic staff.
The April Warning. The Continued Attack. The June 12 Recall. The Dots Connect.
The Alibaba distillation attack and the Fable 5 recall are now confirmed to be temporally connected in a way that changes the reading of both events. Here is the sequence as now documented:
In April 2026, the White House issued a memo to foreign entities warning them to cease distillation attacks against US AI models. The memo’s existence was not public at the time. The Alibaba distillation attack, Anthropic alleges, continued after this warning was issued — from April 22 through June 5. This means the White House was aware that foreign actors were systematically extracting Claude’s capabilities through distillation, had warned them to stop, and observed that the attack continued anyway. On June 10th, Anthropic sent its Senate letter documenting the attack. Two days later, on June 12th, the Fable 5 recall occurred.
Ground Truth has covered the Fable 5 recall across Episodes 08, 09, 11, and 12. The stated trigger was a jailbreak vulnerability. The confirmed contributing factor was an Amazon AWS vulnerability report to the White House. The administration’s conclusion was that it “could not trust Anthropic to safeguard its most advanced AI technology.” The Alibaba distillation attack — in which 28.8 million conversations with Claude were extracted specifically targeting its most advanced capabilities, continuing after a White House warning, through accounts that Anthropic failed to detect and block for six weeks — provides a specific, documented basis for the administration’s trust conclusion that goes beyond the vulnerability report. The recall was not about a specific jailbreak. It was about a demonstrated failure to prevent systematic capability extraction by foreign actors at scale, over weeks, after a government warning. That is a much more serious finding. And it is now documented.
The SK Telecom access revocation — confirmed as a contributing factor to the recall in Episode 11 — has not been publicly connected to the Alibaba distillation attack. The temporal proximity is notable: SK Telecom access was revoked in the days before June 12th; the Alibaba attack ran through June 5th. The question of whether the SK Telecom access revocation was itself related to the distillation investigation — whether SK Telecom was identified as one of the channels through which the 25,000 accounts operated — has not been confirmed. It is the question that the Anthropic IPO due diligence process will need to answer.
The Fable 5 recall was not about a jailbreak. It was about a demonstrated failure to prevent systematic capability extraction by foreign actors at scale, over six weeks, after a White House warning. The jailbreak was the stated trigger. The distillation attack was the documented basis for the trust conclusion. Both are now confirmed. The reading of the recall changes significantly when both facts are held simultaneously.Neal Lloyd · Ground Truth, Episode 16
OpenAI’s First Chip. GPT-5.6 Imminent. DeepSeek at 17x Cheaper. Colorado Takes Effect Monday.
OpenAI and Broadcom unveiled Jalapeño. OpenAI’s first custom AI inference chip, engineered in partnership with Broadcom, was physically delivered to Sam Altman and Greg Brockman on June 25th. The design target: 50% cheaper LLM serving cost compared to running on NVIDIA GPUs. Jalapeño is an inference chip — designed for serving model outputs at scale, not for training — which is where the highest volume and highest recurring cost sits in a consumer AI product like ChatGPT. At 900 million weekly users, a 50% reduction in inference cost is a structurally significant margin improvement. For context: OpenAI is projecting $14 billion in losses in 2026, with compute costs a substantial component. Jalapeño changes that cost structure from the inside. The chip will not ship to production until 2027 at the earliest, but its existence changes the unit economics narrative in the OpenAI S-1.
GPT-5.6 is days away. Polymarket contracts on GPT-5.6 launching before June 28th are priced at 83% probability. The internally codenamed “kindle-alpha” model has been confirmed by multiple developers who spotted the model string briefly in Codex backend logs before it was pulled. Rumoured features: 1.5 million token context window, significantly improved UI generation and front-end code output, faster Codex response times, and a redesigned reward audit pipeline following the documented “Goblin Incident” in GPT-5.5 that produced a 175% increase in creature metaphors in outputs. The Goblin Incident — a reward model miscalibration that caused GPT-5.5 to produce unusually high rates of creature-themed responses — is the most entertainingly named AI safety failure in 2026 and also a genuine example of the reward hacking problem covered in ITM Day 19.
DeepSeek V4-Pro went permanent at 17x cheaper. DeepSeek made its May 2026 promotional price cut permanent this week: V4-Pro is now $0.44 per million input tokens and $0.87 per million output tokens. GPT-5.5 charges $15 per million output tokens. The 17x output cost differential, on a model that matches or approaches GPT-5.5 on most benchmarks, is the number that changes enterprise procurement decisions. High-volume production workloads — the kind that make AI infrastructure decisions based on cost-per-output rather than capability-per-benchmark — have a compelling economic case to switch that requires no compromise on quality in most use cases. DeepSeek V4-Pro is, by this measure, the most commercially disruptive AI pricing event since GPT-3.5 made frontier AI accessible in 2022.
Colorado AI Act takes effect Monday. As covered in Episode 04, Colorado’s AI Act anti-discrimination provisions were originally scheduled to take effect June 30th. A May 2026 amendment significantly modified the liability framework, removing some of the most aggressive consumer protection provisions that consumer rights groups valued most. The amended Act takes effect Monday. Companies using AI in hiring, credit, and housing decisions affecting Colorado residents are now in a live compliance environment. The Great American AI Act has not moved out of committee. Federal preemption remains a future possibility, not a present shield.
Four more Google Gemini researchers joined Anthropic. In the six days following Andrej Karpathy’s resignation from Anthropic — which itself followed John Jumper’s departure from Google DeepMind to Anthropic — four additional senior Gemini researchers announced they are joining Anthropic. The talent signal is now unambiguous. Among frontier AI labs, Anthropic is the current destination of choice for researchers leaving Google. The company whose flagship model has been offline for 14 days is simultaneously experiencing its most significant talent inflow in its history.
28.8 million: Claude conversations extracted by Alibaba distillation attack. 25,000: fake accounts used. 14: days Fable 5 has been offline. 0: traffic being served to Fable 5 per Anthropic staff. 83%: Polymarket probability GPT-5.6 launches before June 28. 50%: OpenAI’s inference cost reduction target from Jalapeño chip. $0.87: DeepSeek V4-Pro output price per million tokens (GPT-5.5: $15). 17x: output cost advantage for DeepSeek V4-Pro. 4: additional Google Gemini researchers joining Anthropic this week. Monday: Colorado AI Act takes effect. $29B: SK Hynix Nasdaq listing targeting July 10. Fable 5: still offline.
Alibaba extracted 28.8 million Claude conversations using fake accounts to train Qwen. The White House was warned in April and the attack continued. Anthropic’s flagship model has been offline for 14 days. OpenAI unveiled its first custom chip. GPT-5.6 is 83% likely to launch before this episode publishes. DeepSeek is 17x cheaper than GPT-5.5. Four more Google researchers joined Anthropic. Colorado AI law takes effect Monday. This is not a slow news week. This has not been a slow news month.Neal Lloyd · Ground Truth, Episode 16
Ground Truth, Episode 16 · June 29 2026
Neal Lloyd covers the real-world impact of AI — money, power, geopolitics, and the stories behind the headlines. Ground Truth is his daily AI news and analysis series on emdexter.blogspot.com.
- Ep 01The Gold Rush
- Ep 02ChatGPT Knows Everything
- Ep 03Siri Is Now Google
- Ep 04America’s AI Law Is a Mess
- Ep 05Is AI Taking Your Job?
- Ep 06Microsoft vs Everyone
- Ep 07SpaceX Is Trading
- Ep 08The Government Pulled Fable 5
- Ep 09Trump and Bernie Want to Own AI
- Ep 10SpaceX Buys Cursor for $60B
- Ep 11The Fable 5 Truth
- Ep 12The Week That Changed Everything
- Ep 13Bots Now Outnumber Humans
- Ep 14Colossus: $80B Compute Landlord
- Ep 15ChatGPT Is Getting Ads
- Ep 16Alibaba Stole 28.8M ConversationsYou are here
