Anthropic says new defenses cut Claude distillation 90-99%

Anthropic says new defenses have cut the data that distillers harvest from its Claude models by around 90 to 99%. It described the measures in a post dated October 12, 2026. Distillation here means copying a model's skills by training a new model on its answers, without permission. Several of the defenses change how Claude's API behaves, so some developers have already had to update their code.

What Anthropic is defending against

Anthropic's post calls distillation attacks "covert, industrial-scale campaigns" to extract a model's capabilities. They often run through networks of fake accounts. The attackers mainly want reasoning transcripts, the step-by-step thinking that shows how Claude reaches an answer.

Anthropic tested why those transcripts matter. It trained a model on Claude Opus 4.8 transcripts and scored it on SWE-bench Verified, a coding benchmark:

Training data	SWE-bench Verified score
Full reasoning transcripts	80.4%
Summarized transcripts	71.8%

Anthropic also argues that copied models can ship without strong safeguards. That raises the risk of misuse in areas such as cyberattacks and biology.

What changed for API users

Anthropic lists these measures:

Measure	Models	What it does
Preserved thinking	Claude Fable 5.1, Opus 5.5	API accounts created on or after August 31, 2026 cannot edit earlier context
Reasoning isolation	Sonnet 5.5 and newer models	Sonnet 5.5 reasoning is visible only to the organization that made the request; older models cannot read newer models' reasoning
Two-stage classifier	Sonnet 5.5, Opus 5 and 5.5, Fable 5 and 5.1	Flags extraction attempts; blocks benign requests in fewer than 0.1% of cases
Billing	Requests blocked by safeguards	Charged since September 24, 2026

Anthropic also patched tricks such as asking Claude to translate its earlier reasoning into another language. Persistent extraction attempts now face tighter usage limits and bans. Anthropic says it has banned tens of thousands of accounts, often within two hours of a campaign starting, Pulse 2.0 reports.

After the classifier went live, the reasoning tokens that attackers extracted fell by a factor of 10 to more than 100, Anthropic says.

Who Anthropic names

The post names two Chinese AI labs. Anthropic says Zhipu used distillation to copy US models' cyber skills while building GLM-5.3. When Claude's safeguards degraded those attempts, Zhipu switched to an older Claude model and another lab's model, Anthropic says. A US government body later rated GLM-5.3 the most cyber-capable open-weights model released to date. We covered GLM-5.3's open-weights release in August.

Anthropic also says requests sent to Moonshot AI's Kimi were secretly forwarded to Claude. OpenAI linked a separate reasoning-extraction campaign to Moonshot AI earlier this month.

Anthropic's September threat report counted nearly 200 million distillation-related exchanges across five campaigns, Crypto Briefing reports. The largest, linked to Alibaba's Qwen, topped 151 million exchanges from May to July 2026.

The costs Anthropic admits

The defenses are not free. Anthropic says it has turned away "meaningful revenue and trillions of tokens' worth of paying traffic." Preserved thinking forced some developers to change their integrations. Benign requests are sometimes blocked, and users are charged for those blocks.

Anthropic says it has not fully met its goal of leaving legitimate users untouched. It expects a cat-and-mouse contest and has not yet seen a highly sophisticated, persistent attempt. "We don't yet know how long these gains will last," the company said, as quoted by Pulse 2.0.

What this means for developers

For teams that build on the Claude API:

• Check the account date. If your API account was created on or after August 31, 2026, you cannot edit earlier context on Fable 5.1 or Opus 5.5. Apps that rewrite past turns, such as trimming or swapping old messages, need another approach.
• Do not plan on sharing reasoning. Sonnet 5.5 reasoning stays with the organization that made the request. A pipeline that passes one model's thinking to another model may break.
• Budget for blocked calls. Requests blocked by safeguards are billed. At fewer than 0.1% the cost is small, but track blocked calls so you notice if the rate climbs.
• Avoid prompts that look like extraction. Asking a model to repeat its prior reasoning word for word is now a pattern the classifier watches for. Keep that out of production prompts.
• Expect more changes. Anthropic calls this an ongoing contest. Watch its release notes for new limits on how reasoning can be read or reused.