Alibaba Launched Qwen 3.6 and Started Distilling Claude the Same Day

On April 22, 2026, Alibaba released Qwen 3.6-27B — a dense 27-billion-parameter model, Apache 2.0 licensed, running in 18 gigabytes on current consumer hardware. Its SWE-bench Verified score is 77.2%, placing it within 3.7 points of Claude Opus 4.6, the Anthropic frontier at launch. That same day — April 22 — according to a letter Anthropic sent to the Senate Banking Committee, operators linked to Alibaba’s Qwen research division began running conversations through Claude using approximately 25,000 fake accounts. By June 5, those accounts had generated 28.8 million exchanges. The date overlap is not background information. It is the whole story.

The 3.7-Point Gap Is Real

SWE-bench Verified is not a toy benchmark. It runs autonomous coding agents against real GitHub issues — actual reported bugs and feature requests in live open-source repositories. Resolving an issue means the agent submits a patch, the patch passes tests, and the maintainer’s criteria are met. A score of 77.2% means Qwen 3.6-27B resolved 77 out of every 100 such issues in the test set without human intervention. Claude Opus 4.6 scored 80.8% on the same benchmark. That 3.7-point gap is real, and it represents roughly two to three months of the open-weight ecosystem’s rate of improvement at its current pace.

The model that achieved this is a dense architecture: all 27 billion parameters active on every token, no mixture-of-experts routing, no sparse activation. Alibaba’s previous flagship, Qwen 3.5-397B, used MoE to reach 76.2% on SWE-bench Verified — at 14.8 times the parameter count. Qwen 3.6-27B does better at a fraction of the size. The architectural explanation is a hybrid attention design: 64 layers alternating Gated DeltaNet blocks with Gated Attention blocks, a combination that handles extended context without the quality degradation that typically appears at long contexts. The context window is 262,144 tokens natively, extensible to one million via YaRN. On AIME 2026 math reasoning it scores 94.1%; on GPQA Diamond scientific knowledge, 87.8%. Those are not open-weight scores. Those are frontier scores. The 3.7-point coding gap is where it stops being a tie.

One feature that distinguishes the model from its predecessors is what Alibaba calls thinking preservation: Qwen 3.6-27B retains its chain-of-thought reasoning traces across multi-turn conversations rather than discarding them between turns. On iterative development work — debugging a function across several exchanges, building out a feature across multiple files — the model maintains context about its own prior reasoning in a way that earlier versions didn’t. This matters for agentic coding tasks where the work spans dozens of tool calls. It is also, specifically, the type of multi-step agentic reasoning that Anthropic’s Senate letter identified as the target of the distillation campaign.

For a local developer, the number that matters is 18 gigabytes. That is the model’s footprint in Q4 quantization — runnable on any M-series Mac with 36GB or more, on a gaming desktop with a 4090, on a corporate workstation without a cloud API key. Simon Willison ran it the day of release and called the SVG generation output outstanding for a model of this scale. The quesma engineering team, whose blog post is driving the current 995-point Hacker News discussion, ran it locally on a MacBook M5 Max — 32 tokens per second, 42GB RAM — and used it for production code generation. Their conclusion was that this is the first local model that didn’t disappoint them. That is a specific reaction from engineers with calibrated expectations, not enthusiasm from a first encounter with language models.

The Campaign Started the Same Day

According to Anthropic’s June 10 letter to Senate Banking Committee Chair Tim Scott and Ranking Member Elizabeth Warren, the distillation campaign linked to Alibaba’s Qwen lab ran from April 22 to June 5, 2026. The accounts were designed to mimic ordinary user traffic while circumventing rate limits and detection systems. The targets were specific: Claude’s frontier-level software engineering and multi-step agentic reasoning — what Anthropic’s infrastructure calls Mythos Preview capabilities, representing the system’s most capable outputs at the time of the campaign.

April 22 is also the date Qwen 3.6-27B shipped. The model was complete — the research, the training, the evaluation, the deployment infrastructure, all done. Nothing a data collection campaign starting on launch day could have contributed to Qwen 3.6-27B. What 28.8 million exchanges with the most capable Claude model available were building, if Anthropic’s account is accurate, is the training corpus for whatever Alibaba ships next.

Anthropic’s framing in the Senate letter is that this constitutes an attempt to “turn hundreds of billions of dollars of American AI investment into a subsidy for a geopolitical competitor.” The company described it as the largest known distillation attack in its history. For scale: the previous record was MiniMax, at 13 million Claude interactions. Moonshot AI reached 3.4 million. DeepSeek reached 150,000 before being detected. Alibaba’s campaign, as described, dwarfed all three combined by a factor of roughly two. Whether it will hold the record is a different question. The method — fake accounts mimicking user traffic — is not sophisticated. It is persistent and large.

Alibaba has not addressed the specifics. The company’s stated position is that it does not use outputs from proprietary AI models to train its own systems and that its AI development complies with applicable intellectual property laws. The campaign figures are Anthropic-stated, surfaced through a Senate letter rather than a court filing, from a company with an obvious interest in how they are characterized. No regulator has ruled on the dispute. The 28.8 million figure and the 25,000 accounts are not independently verified.

The structural counter-argument matters here. Distillation only runs downstream: a model trained on Claude’s outputs is always chasing the version of Claude that existed when the data was collected. The copy approaches but cannot exceed the original. If Alibaba collected Mythos Preview responses through June 5, whatever uses that data has a ceiling at Mythos Preview as of June 5, not at whatever Claude ships next. The legitimate research trajectory visible in the Qwen 3.5 to 3.6 transition — nearly halving parameters while improving benchmark scores — suggests the Qwen team has genuine algorithmic work driving the improvement. The distillation hypothesis and the parallel-research hypothesis are not mutually exclusive. Both can be true, and the benchmark gap would close either way.

The Target Went Offline Two Days After the Letter

On June 9, 2026, Anthropic released Claude Fable 5 and Claude Mythos 5. Fable 5 is the current widely available flagship; Mythos 5 is invitation-only through Project Glasswing. On June 10, the Senate letter became public. On June 12, the US government issued a directive suspending access to both models for all users worldwide. That is a three-day window from launch to suspension.

The stated basis for the June 12 directive was a cybersecurity concern separate from the distillation allegation — a technique for asking Fable 5 to identify software vulnerabilities in a codebase. But the structural effect on the distillation question is plain: the models Alibaba was allegedly studying between April and June are now restricted to a government-managed approved-access list. Fable 5 and Mythos 5, which represent the capability tier above what was available during the alleged campaign, are not publicly accessible. Opus 4.8 is the current publicly available Anthropic model, and it postdates the alleged campaign period. The alleged harvest was of Mythos Preview. Mythos 5 is gated behind Project Glasswing. The next capability tier up from what was collected is not available for collection.

This is a different kind of defense than API rate limiting. Rate limits address throughput. A team willing to operate 25,000 fake accounts is not meaningfully constrained by throughput restrictions. Export controls on the model itself operate differently: they remove the object of study from the accessible surface entirely. The biometric identity gate that Anthropic deployed to restore partial Fable 5 access — government-issued photo ID, live selfie, facial geometry processing — is the mechanism for ensuring that who accesses the capability tier above the alleged harvest is known and approved. Whether this is coherent policy or geopolitically motivated opportunism is a question for legislators. The functional effect is that the collection window that ran April 22 to June 5 is closed, and the next tier up requires cleared identity to open.

The argument Anthropic made to Congress is framed in national security terms: American investment subsidizing a geopolitical competitor. That framing is designed to move the IP dispute into a register where congressional action is plausible. Whether Congress acts on the distillation question specifically is less important than the signal the attempt carries: the US government has now treated the capabilities of a commercial AI model as something worth controlling at the export level, and the companies building the most capable models have accepted that framing, either voluntarily or under compulsion.

Qwen 3.6-27B is at 77.2% on SWE-bench Verified. Claude Opus 4.6, the frontier comparison at launch, was at 80.8%. The gap is 3.7 points, and the model that achieved it is open-weight, locally runnable, and free to deploy anywhere. The next Qwen benchmark announcement will land against whatever the frontier looks like when it ships — Fable 5, if access is restored; Opus 4.8, if it isn’t. What that announcement will not say is whether the training data that moved the number included 28.8 million responses from a model that is now export-controlled. The gap being 3.7 points at the moment of launch and the alleged data collection starting the same morning are facts that the next number will make relevant again.

AI-generated editorial illustration · TemperatureZero · July 2, 2026