The AI dispute over model ownership

Artificial intelligence companies are no longer competing only to build the world's most advanced models, but also to protect the capabilities embedded within them. As frontier AI systems become more capable and more expensive to develop, safeguarding the knowledge embedded within those models is emerging as one of the industry's defining challenges.

That debate intensified in June after Anthropic accused operators linked to Alibaba, one of China's largest technology companies and a major developer of large language models, of conducting a coordinated effort to improve a competing AI system using Anthropic's Claude models. According to Anthropic, the operators generated more than 28.8 million interactions through roughly 25,000 fraudulent accounts between April 22 and June 5, systematically collecting Claude's responses while rotating accounts to avoid usage limits. Although Alibaba has denied the allegations, Anthropic described it as the largest known attempt to extract the capabilities of one of its frontier models.

At the center of the dispute is a technique known as model distillation. Long used by AI researchers as a legitimate method for transferring knowledge between models, distillation is now raising difficult questions when it involves a competitor's proprietary system. The case illustrates how protecting AI capabilities has become a defining challenge as frontier models grow more valuable.

The debate over model distillation

The controversy surrounding model distillation is not about the technique itself. Researchers have used it for decades to create smaller, faster and less expensive models by training them on the outputs of larger systems. Companies routinely distill their own models as part of normal product development, allowing them to reduce computing costs while preserving much of a model's performance.

The legal uncertainty begins when developers use another company's proprietary model as the teacher.

Rather than copying source code, model distillation relies on repeated interactions with an AI system. Developers submit large volumes of prompts, collect the responses and use those outputs to train another model. The process can allow a less capable system to imitate aspects of a more advanced one without ever obtaining access to the underlying software.

The technique drew widespread attention following the emergence of Chinese AI startup DeepSeek, whose models approached the performance of leading Western systems while reportedly using a fraction of the computing resources. Although DeepSeek denied allegations of improper conduct, its success accelerated debate over how much knowledge can be extracted from publicly accessible models and where legitimate reverse engineering ends and intellectual property infringement begins.

According to a March 2025 explainer by the Washington-based policy organization Americans for Responsible Innovation, existing intellectual property law was largely designed to govern the copying of protected works such as software code, not the transfer of capabilities through AI-generated outputs. As a result, courts have little precedent for determining whether learning from a model's responses constitutes lawful competition or unauthorized appropriation.

Protecting the model after it is built

The allegations against Alibaba arrive as frontier AI systems are taking on greater strategic and commercial significance.

Only a small number of organizations now possess the computing infrastructure, engineering expertise and financial resources needed to develop the world's most capable models from scratch. The International AI Safety Report 2026, published in January by an international panel of more than 100 experts, concludes that frontier AI development remains concentrated among a small group of companies because of the computing resources, technical expertise and capital required to train those systems.

As those barriers rise, protecting models after they have been trained has become a priority in its own right.

Anthropic's Responsible Scaling Policy, updated in February 2026, illustrates how companies are approaching that challenge. The policy establishes progressively stronger security requirements as models become more capable, including tighter controls over access to model weights, the billions or trillions of numerical parameters that encode a model's learned knowledge and largely determine how it performs. It also calls for expanded monitoring of insider threats, enhanced cybersecurity protections and stricter deployment safeguards once systems reach defined capability thresholds.

The economics behind capability extraction

The commercial incentives behind model distillation are growing alongside the cost of developing frontier AI.

Building state-of-the-art models demands extraordinary investment in specialized chips, computing infrastructure and highly skilled researchers. Those costs create powerful incentives for competitors to narrow capability gaps without repeating every stage of the development process.

A June report by the Center for a New American Security argues that much of AI's long-term economic value will accrue to the organizations that own frontier models and the infrastructure supporting them. Under that logic, preserving the performance advantage of a frontier model becomes central to protecting the return on billions of dollars in investment.

Distillation disputes therefore extend well beyond intellectual property. They ask whether the capabilities embedded within a frontier model should themselves be treated as a protected competitive asset.

A new challenge for AI governance

Whether Anthropic ultimately substantiates its allegations against Alibaba, the dispute has exposed a challenge that governments, courts and technology companies are only beginning to confront. Existing legal frameworks were developed to govern software code, copyrighted works and conventional trade secrets. Frontier AI presents a different problem. A model's most valuable knowledge may be inferred through millions of interactions even when its underlying code and model weights remain secure.

As policymakers debate export controls, cybersecurity standards and the governance of advanced artificial intelligence, the protection of model capabilities is likely to become a more prominent part of those discussions. The central question is no longer only how to secure AI systems from unauthorized access, but how to protect the knowledge embedded within them when that knowledge can be learned through interaction rather than direct copying.

Regardless of how the Anthropic-Alibaba dispute is ultimately resolved, it signals that competition over frontier AI is entering a new phase. Building the most capable models will remain essential, but protecting the capabilities they contain may become just as important.