Anthropic cuts Claude distillation by up to 99%

What Anthropic announced on October 12

Anthropic published a research post on October 12, 2026 saying its new defenses have reduced the data distillers harvest from Claude by around 90 to 99%. The company calls this early evidence, and the measurement covers its own platform.

A distillation attack is a covert, large-scale effort to copy one model's abilities into another without the original developer's permission. Attackers send huge numbers of prompts, collect the answers and train their own model on them, often through networks of fake accounts.

For how distillation works in general, see What is knowledge distillation? Smaller AI models. Anthropic's objection is to distilling another company's model without its authorization.

Why distillers want Claude's reasoning

The most valuable thing a distiller can collect is Claude's reasoning, the thinking it writes out before it gives an answer. Reasoning shows a smaller model how Claude gets to a result, not just what the result is.

Anthropic tested this. It trained a pretrained Claude model on transcripts from Claude Opus 4.8 and scored it on the SWE-bench Verified coding benchmark. Trained on the full reasoning, the model scored 80.4%, against 71.8% when trained on summaries alone.

Anthropic gives two reasons it treats illicit distillation as a threat. Distilled models can get close to frontier capability while shipping without safeguards to match, a risk in fields such as biology and cybersecurity. Anthropic also says the companies doing the distilling are building those capabilities into foreign military, intelligence and surveillance systems, a topic SOKUFU covered in AI Distillation Attacks in PLA-Linked Research.

Summaries alone did not stop extraction

Anthropic's first fix was to show users a summary of Claude's reasoning, and distillers answered by trying to get Claude to reveal the full version. Tactics ranged from telling Claude to repeat its earlier reasoning verbatim to far more elaborate attempts. One lab tested 12,000 requests, each using a different trick.

Distillers found ways around Anthropic's first safeguards and then scaled up through proxy networks controlling hundreds of thousands of fraudulent accounts. Anthropic's February report found a single network running more than 20,000 accounts at once.

Three defenses against distillation

Anthropic now tackles distillation in three ways: it limits where reasoning can travel, blocks requests that try to pull reasoning out, and makes repeat attempts costly. It says the effect on legitimate users is small, though not zero.

Preserved thinking limits where reasoning can go

Preserved thinking, introduced with Claude Fable 5.1 and Claude Opus 5.5, stops new API accounts from editing Claude's earlier context. It applies to accounts created on or after August 31, 2026. Distillers had been moving protected reasoning blocks between conversations, models and accounts to trick Claude into giving up the full text, and this closes that route.

Older models with weaker safeguards can no longer read reasoning from these two models. With Claude Sonnet 5.5, a reasoning transcript is available only to the organization whose request produced it.

A two-stage classifier blocks extraction requests

Anthropic built a two-stage classifier, modeled on its constitutional classifiers research, to catch requests that try to extract Claude's reasoning. It red-teamed the system against real distillation attempts and says it is now about as robust as the safeguards that stop Claude from helping with bioweapons. The false positive rate is below 0.1%.

The classifier runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. It has already shut down newer tricks, such as asking Claude to translate its earlier reasoning into another language or to write it out in tags next to the answer.

Rate limits, bans and charges for blocked requests

Accounts that keep trying to extract reasoning get tighter usage limits, and persistent offenders are banned. Since September 24, Anthropic has also charged again for requests its safeguards block before Claude responds, in areas such as distillation where the false positive rate is under 0.1%.

How much less reasoning gets out?

Since the classifier went live, the reasoning tokens distillers extract from Anthropic's own platform have stayed 10 to 100 times lower than before, and on some days too small to measure. That is the basis for the 90 to 99% figure. It covers Anthropic's platform only, and the post notes that distillers also spread their traffic across third-party clouds and other inference providers.

Anthropic has banned tens of thousands of accounts tied to distillation, often less than two hours after an account began a campaign. It also turned away trillions of tokens' worth of paying traffic from distillers, along with the revenue that came with it.

The company does not know how long the gains will last. It expects a cat-and-mouse game and says it has not yet seen a highly sophisticated, persistent attempt to get around the new safeguards.

Zhipu and Moonshot are named in the post

Anthropic names two Chinese AI companies. It says Zhipu distilled the cyber capabilities of leading US models while building GLM-5.3. Zhipu went after Claude Fable 5 first, then switched to an older Claude model and another lab's model once Claude's cyber safeguards degraded its attacks.

Anthropic adds that its own research found GLM-5.3's safeguards easy to bypass. For the model itself, see GLM 5.3 benchmarks, pricing, and open weights.

The second case involves Moonshot: Anthropic says requests sent to its Kimi models were secretly forwarded to Claude as part of a distillation effort. One came from a user Anthropic believes was affiliated with China's People's Liberation Army, asking to analyze CCTV footage of a specific person. Both claims come from Anthropic alone, and the post includes no response from either company.

What changes for developers on the Claude API

Many developers do not need to change anything. That covers anyone whose requests are built by Claude Code, claude.ai, Claude Managed Agents or the Claude Agent SDK, and any code that keeps the system prompt and tools fixed and only appends new messages.

Integrations that edit earlier context need changes

Code that rewrites earlier parts of a conversation is what can break. The Claude Platform Docs list the patterns to check, including:

• rebuilding the system prompt between turns, for example to insert the date
• clearing or shortening old tool results
• summarizing old turns on the client while keeping recent thinking
• adding, removing or editing tools mid-conversation

For accounts created on or after August 31, 2026, 00:00 UTC, the API checks by default that nothing before a thinking block has changed. If something has, the API either rejects the request with a 400 error or drops the invalid blocks, depending on which behavior you pick.

Older accounts are not checked by default, so code that runs cleanly on your own key can still fail for users on newer accounts. Sending the thinking-binding-controls-2026-08-01 beta header makes an older account flag the blocks that would fail.

Anthropic is direct about the cost. Preserved thinking forced some developers to update their integrations, the classifier blocks under 0.1% of benign requests, and those blocked requests are billed.

Key points for Claude users

Anthropic's three defenses have left distillers extracting 10 to 100 times less reasoning from its platform, and tens of thousands of accounts have been banned along the way. If you build on the Claude API with an account created on or after August 31, 2026, check whether your code edits earlier context. Anthropic itself says it cannot yet tell how long the gains will hold.