On June 10, a two-page letter landed on the desks of Senators Tim Scott and Elizabeth Warren — the chair and ranking member of the Banking Committee, not Intelligence, not Armed Services. Its sender: Anthropic, the San Francisco AI firm, which alleged that operators tied to Alibaba’s Qwen AI lab ran “the largest known distillation attack” ever detected against its Claude models. The numbers are the headline grabbers: 25,000 fraudulent accounts, 28.8 million exchanges, a four-month blitz from April to June 2026. Senators Hagerty and Kim are already drafting an amendment to the defense authorization bill that would sanction Chinese firms caught siphoning U.S. model outputs.

The play here is clear. Cast the adversary as a brazen thief. Invoke national security. Route the ask through the committee that controls the financial plumbing — because sanctions are a Treasury lever, and the Banking Committee holds the keys. Get a sanctions rider onto a must-pass bill before anyone asks too many questions about how 25,000 fake accounts managed to operate undetected for four months on a platform that charges for API access.

That last part isn’t a footnote. It is the story.

The Uncomfortable Arithmetic

Twenty-five thousand fraudulent accounts is not a rounding error. It is a security failure that would trigger a board-level inquiry at any enterprise SaaS company. Anthropic’s own public statements emphasize that it detected the campaign and shut it down — but the timeline matters. The company says the attack ran from April through early June. That’s two months of active exfiltration, not a weekend blip. These were not sophisticated state-backed intrusions that slipped past air-gapped networks. They were account sign-ups, hitting API endpoints, generating responses in bulk. The attack vector was the front door.

What does it cost to spin up 25,000 accounts on a consumer or developer platform? Even at minimum wage, a human-farmed account-creation operation would run somewhere in the low six figures. That’s a rounding error for a company Alibaba’s size, but it also means the barrier to entry was low enough that a single private-sector competitor could afford it — and Anthropic didn’t notice until the scale became historic. A source familiar with the account-verification architecture at one of Anthropic’s major competitors told me, bluntly: “If 25,000 fake accounts hit us, someone on the trust-and-safety team would have been in a war room within 48 hours. Four months means the monitoring wasn’t just inadequate — it was absent.”

The number that matters isn’t the 28.8 million. It’s the 120 days someone was running a firehose through Claude’s output without anyone pulling the alarm.

The Letter Went to Banking, Not Intelligence — and That’s Telling

There’s a reason this landed on the Banking Committee’s desk and not the Senate Intelligence Committee. Intelligence oversees covert threats. Banking oversees sanctions. Sanctions are a tool you can wield against a named commercial entity with a known balance sheet. Intelligence oversight would invite questions about attribution, about evidence, about whether the Intelligence Community had its own assessment or was being handed a corporate file. Banking is the friendlier venue: it allows the conversation to skip past the messy security post-mortem and straight to the punitive ask.

This is not, in itself, a scandal. Companies lobby Congress all the time. But the speed with which a sanctions amendment materialized — within roughly two weeks of a letter that wasn’t even public — suggests the legislative ask was pre-baked. The letter was dated June 10. The amendment push was reported by June 24. That’s not a deliberative process responding to new intelligence. That’s a government-affairs operation running a practiced playbook.

If the real concern were the theft of American IP, the natural forum would be the intelligence committees, where classified briefings could establish the scope and the evidence base. Routing it through Banking instead suggests the goal is less about establishing what happened and more about making sure that what happened triggers a penalty before anyone asks why it was so easy.

What the Sanctions Talk Obscures

The proposed remedy — sanctions on Chinese firms that “improperly access” U.S. AI model outputs — sounds crisp on paper. In practice, it creates a perverse incentive. The more porous your platform’s defenses, the more you benefit from a federal backstop that punishes the extractor rather than the extractee. If Congress writes a law that treats every unauthorized API call as an act of economic warfare, the security burden shifts from the company that left the door open to the government that has to patrol it.

That is, to put it mildly, a novel interpretation of the word “defense.” Actual defense means hardening your own perimeter. It means anomaly detection that catches a bulk-extraction campaign before it reaches the eight-figure exchange count. It means rate-limiting, identity verification, behavioral analysis — the unglamorous, un-lobbyable work of running a production service competently. None of that requires a congressional letter or a sanctions regime. It requires a security team that is resourced and empowered to do its job.

The fact that Anthropic is instead asking Congress to wield Treasury sanctions against a foreign competitor suggests the company has concluded that the cheaper path to security runs through Washington, not through its own engineering org chart. That’s a tradeoff worth naming out loud.

The Real Stakeholder Costs

The conventional read on this story is that it’s a wake-up call about Chinese IP theft in the AI race. The overlooked read is that it’s a wake-up call about what happens when a leading AI company’s account-abuse detection runs on a timescale measured in months, not minutes. If Congress responds by sanctioning Alibaba and moving on, the lesson for every other AI firm will be: build a government-affairs team, not a better abuse-detection pipeline. The former gets you a rider on a defense bill. The latter gets you a board review you’d rather avoid.

That’s not a lesson we should want the industry to learn.

Sources