The Week AI Went to War — With Itself

Anthropic Accuses Alibaba of Running 29 Million Fake Queries to Clone Claude

On 25 June, Bloomberg and CNBC confirmed the contents of a letter Anthropic sent to US Senators Tim Scott and Elizabeth Warren on 10 June. The allegation: operators linked to Alibaba's Qwen AI lab used approximately 25,000 fraudulent accounts to run 28.8 million exchanges with Claude between 22 April and 5 June 2026. Anthropic called it the largest known distillation attack against the company to date — and took the evidence directly to the White House and Congress.

Distillation is a technique where a company sends thousands of carefully crafted prompts to a competitor's model, harvests all the outputs, and uses that data to train its own model. No passwords stolen. No firewalls breached. The attackers simply used Claude exactly as any legitimate user would — at industrial scale, through fake accounts. According to Anthropic's letter, the campaign specifically targeted Claude's most strategically valuable capabilities: agentic reasoning, software engineering proficiency, and long-horizon task completion. The capabilities that enterprises are paying the most for.

The scale dwarfs anything seen before. In February, Anthropic had named three other Chinese labs — DeepSeek, Moonshot, and MiniMax — for collectively running 16 million exchanges through 24,000 fraudulent accounts. Alibaba's alleged campaign exceeded all three combined in six weeks. Alibaba has not publicly responded. Its shares fell approximately 3% on the news.

OpenAI Unveils Jalapeño — Its First Custom Inference Chip, Built With Broadcom

On 24 June, OpenAI and Broadcom physically unveiled Jalapeño, OpenAI's first custom AI inference processor. The chip was designed from scratch in nine months — roughly half the typical ASIC development timeline — and is purpose-built for large language model inference, not training. Early testing shows substantially better performance-per-watt than current state-of-the-art GPU alternatives, with early reports suggesting approximately 50% lower inference cost versus mainstream AI GPUs.

The strategic intent is clear. Inference — running a trained model in response to user requests — is where AI costs are crushing margins. Every ChatGPT answer, every Codex task, every API call burns inference cycles. OpenAI has been entirely dependent on Nvidia GPUs for inference to this point, putting it at a structural cost disadvantage against Google, which uses its own TPUs, and Amazon, which uses Trainium. Jalapeño is the first step toward closing that gap. Deployment at Microsoft Azure and partner data centres is targeted for end of 2026, with volume production planned for 2027.

GPT-5.6 also entered the picture this week — but with a government complication. On 27 June, Reuters confirmed that OpenAI delayed the full public rollout of GPT-5.6 at the request of the Office of the National Cyber Director and the Office of Science and Technology Policy. It marks the first time the US government has formally staged a frontier model release for national security review. Developers and enterprise teams expecting access now face a case-by-case federal approval process.

Agentjacking: The New Attack Class Targeting Your AI Coding Agents

A new attack class called Agentjacking was disclosed this week and is directly relevant to any enterprise running Claude Code, Cursor, or OpenAI Codex. The attack works through fake Sentry error reports that contain markdown injection. When an AI coding agent reads the injected error report — which it is designed to do as part of debugging — it interprets the injected instructions as legitimate guidance and executes malicious commands. The attack achieved an 85% exploitation rate and had already affected 2,388 organisations at the time of disclosure.

The reason this is significant beyond the raw numbers: developers have trained themselves to trust their coding agents. When Claude Code identifies an error and recommends a fix, you act on it. That trust is the attack surface Agentjacking exploits. The mitigation is straightforward but requires a deliberate habit change: all output from error-tracking platforms must be treated as untrusted input before being passed to an AI coding agent. The agent should never automatically execute instructions that originate from external monitoring tools without human review of the original source.

GPT-5 Pro Cracked a Three-Year Immunology Mystery — and Predicted an Unpublished Result

On 24 June, OpenAI published the account of immunologist Dr. Derya Unutmaz, who used GPT-5 Pro to revisit a three-year-old puzzle about how glucose affects T cell development — immune cells that fight viruses, cancer, and autoimmune disease. The finding had stalled because the data was too complex to synthesise manually across hundreds of intersecting papers. GPT-5 Pro identified the mechanism within a single research session.

The more striking result: GPT-5 Pro correctly predicted the outcome of an experiment Unutmaz had already conducted but not yet published. The model could not have found the result through web search — it did not exist publicly. The implication is that frontier models have now reached a level of scientific understanding that allows them to reason predictively about experimental outcomes in specialised domains, not merely retrieve and summarise existing knowledge. Unutmaz described the models as functioning more like research collaborators than search tools.

Colorado's AI Act Is Effectively Dead — and That Tells You Everything About US AI Regulation

Today, 30 June, was the original effective date of the Colorado AI Act — the first comprehensive US state AI law, enacted in 2024. It never took effect. Governor Polis signed a replacement bill (SB 26-189) on 14 May 2026, repealing the original framework entirely and pushing the new, significantly narrower law to January 1, 2027. The duty of care standard, mandatory risk management programmes, annual impact assessments, and algorithmic discrimination obligations are all gone. The replacement focuses on disclosure and transparency requirements only.

The story behind the collapse is instructive. xAI filed a constitutional challenge in April 2026. The DOJ intervened to support the challenge. The Colorado Attorney General stipulated to a stay. A federal magistrate judge issued an injunction. The White House issued executive orders seeking to preempt state AI laws at the national level. What was positioned as the landmark US state AI framework — the one that was supposed to set the standard for the rest of the country — was dismantled under coordinated federal pressure within months of its effective date. The US regulatory posture is now clearly converging on transparency and disclosure, not the substantive risk management model Europe adopted.

Abu Dhabi's MGX Closes a $50 Billion AI Fund — The Largest of Its Kind

On 23 June, Bloomberg confirmed that MGX — Abu Dhabi's state-backed AI investment firm, chaired by UAE National Security Adviser Sheikh Tahnoon bin Zayed Al Nahyan — has raised close to $50 billion from regional sovereign wealth funds, global pension funds, and large institutional investors. The fund has already begun deploying capital. The minimum LP ticket stood at $500 million, making this exclusively institutional-grade capital at a scale that has no precedent in dedicated AI investment.

The strategic significance goes beyond the number. MGX is currently the only investor globally with active stakes in all three frontier AI labs — OpenAI, Anthropic, and xAI — alongside major infrastructure partnerships with BlackRock, Microsoft, and Nvidia. It was also a founding partner in the $500 billion Stargate Project and co-led the $40 billion acquisition of Aligned Data Centers in October 2025, the largest data centre deal ever recorded. The $50 billion raise widens MGX's capacity to pursue deals that state capital alone could not support, and signals that global institutional investors — Western pension funds included — are now prepared to put long-duration capital behind Abu Dhabi's AI infrastructure agenda at global scale.

For context: MGX is targeting over $100 billion in total assets under management and has signalled deployment of up to $10 billion annually in AI investments going forward. Abu Dhabi is not positioning itself as a passive capital exporter. It is positioning itself as an active builder and co-owner of the infrastructure that will run frontier AI for the next decade.

What the Week Means for Enterprise AI Leaders

Five stories. One coherent signal. The rules governing who can build AI, who can access it, who can copy it, and who can attack it are being rewritten in real time — and they are not being written by the technology teams. They are being written in congressional hearing rooms, federal courtrooms, chip fabrication plants, and government export control offices.

The enterprises that will lead in this environment are not the ones with the fastest AI adoption. They are the ones with the most resilient AI architecture: model-agnostic, governance-first, with human oversight built into every high-stakes agentic workflow. The capability race is real. The infrastructure and governance race is the one that determines who stays in it.