Anthropic says new defenses cut distillers’ haul 90% to 99%

Anthropic says new defenses are making it much harder for rivals to copy Claude, according to an Oct. 12 research post.

“Early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99%,” the company wrote. The figures are Anthropic’s own, measured on its own platform.

The rule in English

Distillation attacks use one model’s answers to train a copy, without the original developer’s OK, Anthropic says. They often run through networks of fraudulent accounts. The prize is Claude’s written-out reasoning.

Anthropic says Zhipu distilled cyber capabilities from leading U.S. models while developing GLM-5.3. It also cites a case it reported earlier in which “requests to Moonshot’s Kimi models were secretly forwarded to Claude as part of its distillation efforts.”

Anthropic says its new safeguards against those attempts are now roughly as robust as the ones that stop Claude from helping build bioweapons. Its rules:

• Preserved thinking: New API accounts, created on or after Aug. 31, 2026, can’t edit Claude’s prior context on Claude Fable 5.1 and Claude Opus 5.5.
• Locked reasoning: Earlier models with weaker safeguards can’t read these models’ reasoning. On Claude Sonnet 5.5, only the organization that made a request can see its reasoning.
• Classifiers: A two-stage classifier screens for extraction attempts. Anthropic says its false positive rate is under 0.1%.
• Penalties: Repeat offenders face tighter usage limits and bans. Since Sept. 24, Anthropic again charges for requests its safeguards block before Claude responds, in areas such as distillation where false positives are under 0.1%.

Anthropic says reasoning tokens extracted by distillers are now 10 to 100 times lower than before. It says it has banned tens of thousands of accounts, often within two hours of a campaign starting.

Who wrote it

Anthropic, in a company research post. No author is named.

Who it binds

Anyone using Anthropic’s most capable generally available models: Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. Anthropic plans to apply the classifier to similar future models.

Who it exempts

Anthropic runs the classifier only on the models listed above. The preserved-thinking change applies to API accounts created on or after Aug. 31.

What it means for you

Founders building on Claude: expect to update integrations. Anthropic says preserved thinking has already forced some developers to do so.

Developers and workers: a small share of harmless requests may be blocked, under 0.1% by Anthropic’s count, and blocked requests are billed.

Anthropic says the trade-offs are worth it. It also says it turned away meaningful revenue to fight distillers.

What’s next

Anthropic says distillation will stay a cat-and-mouse game. It does not know how long the gains will last and has yet to see a highly sophisticated, persistent attempt to beat them.

Anthropic says it expects attackers to find ways around the safeguards.

It says platforms and developers can slow distillation by quickly detecting abuse and offboarding fraudulent accounts. Watch whether other developers and cloud platforms adopt similar defenses.