FBI Said Alibaba Copied Anthropic — US Gov Site Ran Qwen
Update, Sept. 17: As of Thursday evening, neither the National Archives nor the White House had responded to requests for comment, and the FBI declined to comment. The Qwen-powered search option was removed Sept. 16, around the time social-media posts about it began circulating, per Reuters. Watch next: Treasury Secretary Scott Bessent meets Chinese Vice Premier He Lifeng this weekend, and President Trump meets President Xi Jinping in Washington on Sept. 24.
Here is the sentence Washington's China hawks will have trouble getting over: less than two weeks after the FBI accused Alibaba of pillaging an American AI company's technology, a U.S. government website was quietly letting the public search federal regulations with Alibaba's own AI model.
The website was the Federal Register's — the official daily journal of the federal government, run by the National Archives — and the model was Qwen, Alibaba's open-weight AI. Reuters reported Thursday that the Qwen-powered search tool sat on the site alongside other search options until it was taken down on Wednesday, around the same time social-media posts about it began circulating. It is not clear when the tool was first deployed.
The Find: Alibaba's Qwen on the Federal Register Site
The details, as Reuters pieced them together from screenshots and an archived version of the site's source code, are strikingly simple. The Federal Register website, which publishes the daily list of newly proposed federal regulations, offered visitors an AI search option built on Alibaba's Qwen to browse public comments on those regulations.
Whoever in the federal IT stack made that choice picked the one model currently at the center of the loudest U.S. accusation against a Chinese AI company in years. And when the mismatch became visible online, the tool vanished.
The Federal Register said nothing, at least on the record. The FBI declined to comment on Thursday, Reuters reported. The National Archives and the White House did not respond to requests for comment.
That silence is worth sitting with for a moment. The federal government has spent the past year warning American companies, in increasingly blunt terms, about the national security risks of integrating Chinese AI models into products used by Americans. In April, the House committees on China and homeland security sent a letter to Airbnb — which also uses Qwen — demanding details about its use, as part of an investigation into what the committees called the "national security risks created by the integration" of Chinese AI tools into American platforms. And yet, on a federal website itself, the same model was sitting one click away.
How we got here: the "malicious distillation" charges
The timing is what turns an embarrassing procurement anecdote into a genuinely consequential story. On Sept. 8, the National Security Agency, the Cybersecurity and Infrastructure Security Agency, and the FBI issued a joint cybersecurity advisory — AA26-251A — accusing six China-based AI companies of conducting "industrial-scale" distillation campaigns against American AI labs.
The named companies: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. The agencies said the firms had extracted billions of tokens across millions of exchanges from U.S. frontier models — variants of Claude, GPT, Gemini, and Grok — since at least late 2024, "likely with Chinese government awareness," and that the campaigns formed the core of the companies' AI development strategies rather than a supplement to them. On Alibaba specifically, the advisory said the company "leveraged industrial-scale distillation to improve the company's Qwen family of AI models."
That followed months of private-sector findings. Anthropic had told Congress, in a letter first reported by Bloomberg, that operators tied to Alibaba's Qwen lab generated 28.8 million exchanges with Claude through roughly 25,000 fraudulent accounts — the largest distillation campaign the company had ever documented. Reuters later reported Anthropic had observed more than 151 million exchanges attributed to Alibaba between May and July 2026 alone, peaking at nearly 3 million a day.
Beijing, for its part, has rejected the entire frame. China's commerce ministry said on Sept. 9 that the allegations lacked factual basis and legal grounding, accused Washington of double standards, and called distillation a neutral technical method — adding that some U.S. companies had themselves "extensively distilled Chinese models." (For the full backstory on the advisory and Beijing's threats of countermeasures, see our earlier report: US Says China's AI Giants Are Stealing American Models — and Beijing Just Threatened Countermeasures.)
The awkward nuance: this may not have been a security disaster
Here is the part that makes the story more interesting than a simple gotcha. The AI experts Reuters spoke with did not describe the Federal Register's Qwen use as an obvious national security catastrophe — and the reasons matter.
Qwen is an open-weight model, meaning key components of the system are publicly available, and developers can download and run it on their own infrastructure rather than sending queries to Alibaba's servers. As security experts have pointed out, that architecture gives organizations greater control over data that might otherwise be shared with outside providers. Georgetown Law professor Anupam Chander told Reuters the use did not appear to present an immediate cybersecurity risk — though, he cautioned, that depends on how the model was trained. And the Federal Register's content is already public by design: proposed regulations and the public comments on them. The model was not handling classified material.
Sen. Mark Warner, the Virginia Democrat who serves as vice chairman of the Senate Intelligence Committee, drew the crucial line in a statement: the real risk, he said, depends on whether U.S. data ever left the government's security boundary and was processed on Alibaba-controlled systems. If the tool ran locally on government infrastructure, the exposure is limited. If queries were routed back to Alibaba, the picture changes.
But even the experts who downplayed the security stakes flagged the political and messaging damage. As Reuters put it, the episode "raised questions about whether the federal government was contradicting its own messages about Chinese AI models."
FBI Qwen Case FAQ: Was the Federal Register Tool a Security Risk?
Why did the US government use Alibaba's Qwen? It is not clear who deployed it or when — Reuters reported the tool's deployment date is unknown. Qwen is an open-weight model, meaning it can be downloaded and run on an organization's own infrastructure rather than sending queries to Alibaba's servers — one reason experts say the choice may have been practical rather than nefarious.
Was the Federal Register's Qwen tool a national security risk? The experts Reuters spoke with did not describe it as an obvious one. Georgetown Law professor Anupam Chander told Reuters the use did not appear to present an immediate cybersecurity risk — though, he cautioned, that depends on how the model was trained. And the Federal Register publishes public content by design.
What is the real risk, then? Sen. Mark Warner (D-Va.), vice chairman of the Senate Intelligence Committee, said it depends on whether US data ever left the government's security boundary and was processed on Alibaba-controlled systems. If the tool ran locally on government infrastructure, the exposure is limited; if queries were routed back to Alibaba, the picture changes.
Reaction: 'One of the Most Insane Things I've Ever Seen'
That contradiction is what landed with Daniel Castro, president of the Information Technology and Innovation Foundation, a Washington think tank. There is, he said, a stark disconnect between the fierce U.S.–China competition to build superior AI models and a U.S. agency choosing to use a Chinese-made one.
"It's one of the most insane things I've ever seen." — Daniel Castro, president of the Information Technology and Innovation Foundation, to Reuters
He has a point that goes beyond the specific model. The federal government is simultaneously the chief prosecutor of the case against Chinese AI distillation and, apparently, a customer of its most prominent target. You do not need to believe the Qwen tool was a data-theft vector to see why that is corrosive: every warning Washington issues about Chinese models now comes with a ready-made rebuttal — your own website was running one.
The summit problem
The calendar makes all of this harder to contain. Chinese President Xi Jinping is expected in Washington for a state visit next week, with a meeting with President Trump slated for Sept. 24, and AI is set to dominate the agenda. Reuters reported this week that the race for AI supremacy will hang over the summit — the two sides are at odds over chip access, technology copying, and AI regulation alike. Treasury Secretary Scott Bessent is meeting Chinese Vice Premier He Lifeng this weekend to talk AI before the leaders sit down.
Bessent told Axios this week that Washington is "open to discussions on avoiding shared risks" and that he expects the talks to cover "both open and closed weight models." It is a notable phrase: Qwen is exactly the kind of open-weight model those talks will cover. American officials will now walk into those rooms having just pulled an Alibaba model off a federal website — days after formally accusing Alibaba of industrial-scale theft from an American AI lab.
CNN reported separately that Trump officials are even considering a sideline meeting with AI executives — Sam Altman of OpenAI and Jensen Huang of Nvidia are expected at the state dinner — to discuss the technology's future and risks. Whatever the agenda, the Federal Register episode will be in the room, unspoken or not.
What this reveals — and what stays unanswered
Strip away the irony and the story is really about governance. Somewhere in the federal technology apparatus, someone selected a Chinese-built AI model for a public-facing government service — possibly for entirely sensible reasons, like cost or performance, since open-weight models are often cheaper to deploy than closed models from Anthropic or OpenAI. Reuters reported it was unclear when the tool was deployed, which means we do not know whether the choice predated the FBI's accusations or came after them. Both possibilities are instructive in different ways.
What remains unanswered is the full set of basic questions: who approved the deployment, whether any government data left U.S. control, whether the model was the community open-weight release or something else, and whether other federal sites are running similar tools. The National Archives' silence is not, by itself, an admission of anything — but it leaves a vacuum that the next discovered instance will fill.
For now, the episode stands as a small, almost absurdly on-the-nose symbol of the moment Washington finds itself in: locked in a tech cold war it describes in existential terms, while its own websites were — until someone on social media noticed — running the other side's software.
What Happens Next: Bessent's Weekend Meeting and the Sept. 24 Trump–Xi Summit
With Xi Jinping expected in Washington next week for a Sept. 24 meeting with President Trump, and Treasury Secretary Scott Bessent meeting Chinese Vice Premier He Lifeng this weekend, the Qwen episode will follow the Americans into the room. Bessent told Axios Washington is "open to discussions on avoiding shared risks" and expects the talks to cover "both open and closed weight models" — and Qwen is exactly the kind of open-weight model those talks will cover. American officials will now sit down days after formally accusing Alibaba of industrial-scale theft from an American AI lab — and days after pulling Alibaba's model off a federal website.
Sources: Reuters (exclusive report, Sept. 17; "AI rivalry hangs over Trump-Xi talks" factbox, Sept. 16; Bessent–He Lifeng meeting, Sept. 15; U.S. accusations against Chinese AI firms, Sept. 8); CNN (AI executive meeting on Xi-visit sidelines, Sept. 16); Axios, via Reuters (Bessent statement on weekend AI talks); the joint NSA/CISA/FBI cybersecurity advisory AA26-251A (ic3.gov, Sept. 8); China's commerce ministry statements via Reuters and Xinhua (Sept. 9); TheStreet and Digital Watch Observatory on the Sept. 8 advisory.
Comments
Post a Comment