Anthropic says it cut distillation theft from Claude by 90 to 99 percent

October 12, 2026. Anthropic publishes a research post titled Strengthening our defenses against distillation attacks. 90 to 99 percent. That is the drop in data harvested by distillers the company claims, with extracted reasoning tokens down by 10x to 100x or more — on some days too small to measure. Since September 24, 2026. Anthropic has also been charging for requests its safeguards block. Why it matters: distillation has become the central conflict of frontier AI in 2026, and a lab is finally documenting, mechanism by mechanism, how it intends to make the attack economically unviable.

What distillation is, and why a lab is obsessed with it

Distillation means training one model on another model’s outputs. Done openly, it is an ordinary compression technique. What Anthropic fights is the covert, industrial version: campaigns that copy a frontier model’s capabilities through fake accounts, resold access and stolen payment details. The stakes are not only commercial. A distilled model approaches frontier capability without inheriting the original’s safeguards, which matters most in biology and cybersecurity. And the company adds a national security reason: distillers would fold the stolen capability into foreign military, intelligence and surveillance systems.

The post names two cases. Zhipu allegedly distilled the cyber capabilities of American models while developing GLM-5.3 — which a US body, the CAISSI, ranks as the most cyber-capable open-weights model released to date, and whose safeguards Anthropic says are easily bypassed. Moonshot, stranger still, allegedly saw requests meant for its Kimi models quietly forwarded to Claude — and one user, believed to be affiliated with China’s People’s Liberation Army, used that route to try to analyze CCTV surveillance of a specific individual. These are Anthropic’s allegations; the companies named have not responded in detail.

Why reasoning is worth stealing

The mechanics of the attack explain the mechanics of the defense. A reasoning model emits reasoning transcripts (chain of thought) that are worth far more than the final answer to a distiller. Anthropic gives a number: on SWE-bench Verified, a model trained on full Claude Opus 4.8 transcripts scores 80.4 percent, versus 71.8 percent on summarized transcripts. That nearly 9-point gap is exactly what distillers try to steal.

Attackers evolved in three steps. First, hide the reasoning: Claude already summarized its thinking before showing it. Second, active extraction: pushing the model to reveal its reasoning, for instance by asking it to restate it verbatim — one lab reportedly tested 12,000 such requests. Third, industrialization: proxy networks controlling hundreds of thousands of fraudulent accounts, with forged identities and stolen payments. The February 2026 report described a single network managing more than 20,000 accounts at once.

The three defenses, one by one

The first defense is structural. Anthropic calls it preserved thinking. For Claude Fable 5.1 and Opus 5.5, API accounts created after August 31, 2026 can no longer edit prior context, which blocks the trick of rewriting or replaying reasoning into another conversation. Reasoning is no longer readable by earlier, weaker-safeguard models, and for Sonnet 5.5, transcripts are accessible only to the organization that produced the request. The direct consequence for developers: anyone who edits or splices earlier turns in agent loops must revisit their integration.

The second defense is a two-stage classifier, built on Anthropic’s constitutional classifiers research. It runs on Sonnet 5.5, Opus 5 and 5.5, Fable 5 and 5.1, with a false-positive rate below 0.1 percent — on par with the bioweapons safeguards. It already blocks techniques such as asking Claude to translate its reasoning into another language or to write it out inside tags. Anthropic says it catches every technique listed in its September 2026 threat report — a claim about known techniques, not a promise about new ones.

The third defense is economic. Accounts that keep trying face tighter limits and then bans — tens of thousands of distillation-linked accounts have been removed, often within two hours of a campaign starting. And since September 24, blocked requests are billed, in areas where the false-positive rate sits under 0.1 percent.

What this changes for anyone building on Claude

Most developers will never trigger the classifier. Still, a few practical points follow. Audit context editing: if your agent harness rewrites earlier turns, test it on an account created after August 31, 2026 before assuming parity. Watch the bill: blocked requests can be billed, and a high-volume pipeline will see a few despite the sub-0.1 percent rate. Do not ask the model to dump its reasoning: prompts like “restate your reasoning verbatim” are precisely the pattern the classifier targets. Beware resellers: if you buy Claude access through a third party that cannot explain its sourcing, the account may be one of those banned in bulk.

The deeper conclusion goes beyond Anthropic. Access to reasoning is becoming a governed resource that providers will ration. Anthropic itself concedes a cat-and-mouse game, and says it has not yet seen a sophisticated, persistent circumvention attempt.

What is claimed, and what is not

The numbers in the post come from Anthropic. No independent audit confirms the 90 to 99 percent drop, the fall in reasoning tokens, or the false-positive rate, and the company does not publish its methodology for measuring attempts it never sees. A defense measured against the attacks a provider can detect will always look good against detected attacks. Anthropic is candid about its limits, but the reader’s caution should match: these defenses are documented progress, not a victory.

Verdict

If you build on the Claude API, review your context-editing code, expect occasional blocks, and treat reasoning access as a privilege that is tightening — not a settled feature. If you consume reasoning models, add reasoning extraction to your threat model: watch for unusual call volumes, repetitive prompt patterns and accounts probing a model about its traces, and demand documented distillation detection from your providers. And if you track AI geopolitics, remember one thing: distillation has moved from commercial annoyance to national security subject, and every lab is now compelled to document its defenses the way a security vendor documents its patches.

References

• Anthropic — Strengthening our defenses against distillation attacks (October 12, 2026)
• Anthropic — Detecting and preventing distillation attacks
• explainx.ai — Anthropic Distillation Defenses: 90-99% Less Data Stolen (October 2026)
• CISA — Joint Cybersecurity Advisory on AI model distillation (September 8, 2026)