Anthropic Battles Large-Scale Distillation Attacks on Claude as AI Model Theft Concerns Grow

Anthropic is strengthening its defenses against large-scale AI distillation attacks after identifying coordinated campaigns that allegedly used thousands of accounts to extract capabilities from its Claude models. The company says these operations generate massive volumes of carefully designed prompts and model responses, which can then be used to train competing AI systems. In an October 12, 2026, update, Anthropic said its latest safeguards had reduced the amount of data harvested by distillers by an estimated 90% to 99% in early assessments.

The issue highlights a growing challenge for frontier AI developers: protecting the capabilities they spend billions of dollars developing while allowing legitimate users to access their models. Anthropic previously disclosed campaigns it attributed to DeepSeek, Moonshot and MiniMax, and its September threat intelligence report described additional activity linked to seven China-based AI laboratories. These are Anthropic’s own findings and attributions, not independent judicial determinations. The company says it is responding with stronger technical safeguards, behavioral monitoring, account restrictions and measures designed to prevent unauthorized extraction of Claude’s reasoning.

Key Takeaways

• Large-scale attacks: Anthropic says AI laboratories used coordinated account networks to collect Claude responses for model training.
• 90%–99% reduction: The company reports that new safeguards have sharply reduced the amount of data harvested by distillers.
• Millions of exchanges: Anthropic’s February disclosure described more than 16 million exchanges across approximately 24,000 fraudulent accounts.
• Additional campaigns: Its September report identified and disrupted further operations it attributed to seven China-based AI laboratories.
• Reasoning is a target: Attackers allegedly sought Claude’s reasoning traces, coding ability, agentic behavior and other capabilities.
• Stronger account controls: Anthropic has introduced restrictions on repeated extraction attempts, account bans and changes to how protected reasoning is handled.
• A wider industry issue: Distillation is a legitimate AI training technique, but unauthorized extraction raises questions about intellectual property, privacy, security and competition.

What Are AI Distillation Attacks?

AI distillation is a training technique in which a smaller or less capable model learns from the outputs of a more capable model. The larger model acts as a teacher, producing answers or examples that help the smaller model learn patterns, solve problems and reproduce certain capabilities.

The method is widely used across the AI industry. Developers can use distillation to create models that are cheaper to run, faster to respond or easier to deploy on devices with limited computing resources.

The controversy arises when one company systematically extracts another company’s model outputs without authorization and uses them to replicate valuable capabilities.

In a typical illicit distillation campaign, operators submit large numbers of carefully designed prompts to a target model. They collect the responses and use those exchanges as training data for their own systems. Some campaigns may also use the target model to evaluate answers, generate training tasks or expose reasoning that would otherwise remain protected.

The distinction is important: distillation itself is not inherently an attack. The concern is unauthorized, large-scale extraction that violates access rules or other applicable restrictions.

Anthropic says the campaigns it identified were not ordinary customer usage. They allegedly involved coordinated networks of accounts, repetitive prompts and requests concentrated on capabilities that are valuable for training advanced AI systems.

Anthropic’s Findings: More Than 16 Million Exchanges

Anthropic publicly disclosed its first major set of distillation allegations on February 23, 2026. The company said it had identified campaigns involving DeepSeek, Moonshot and MiniMax, which it attributed to those laboratories with what it described as high confidence.

According to that disclosure, the three campaigns generated more than 16 million exchanges with Claude through approximately 24,000 fraudulent accounts.

Anthropic said the operations targeted capabilities including agentic reasoning, tool use and software engineering. It described account networks that distributed traffic across multiple accounts and proxy services, making it harder to identify the activity through individual-account monitoring.

The company also said the campaigns used prompts designed to collect information useful for training models, rather than simply obtain answers for normal end-user tasks.

These allegations are significant because frontier models require substantial computing resources, research expertise and engineering time to develop. If a competitor can obtain large volumes of high-quality training examples from an existing model, it may be able to improve its own system more quickly than it otherwise could.

However, extracted responses do not automatically reproduce a model’s full architecture, training data or capabilities. The value of the collected material depends on its quality, the training methods used and how well the resulting model generalizes to new tasks.

Anthropic’s disclosures describe its investigation and attribution. The findings should be understood as the company’s claims rather than proof that every model improvement by the named laboratories resulted from distillation.

New Safeguards Reportedly Reduce Data Extraction by 90%–99%

On October 12, Anthropic published an update describing new defenses designed to make distillation attacks harder to execute.

The company said early evidence suggested these measures had reduced the amount of data harvested by distillers by approximately 90% to 99%. The estimate is Anthropic’s own assessment; it should not be interpreted as an independently verified reduction across every possible attack.

The updated approach focuses on three areas: controlling access to protected reasoning, detecting suspicious usage patterns and making repeated extraction attempts more difficult.

1. Protecting reasoning traces

One reported technique involved attempts to persuade Claude to reveal detailed reasoning transcripts by moving protected reasoning between conversations, models or accounts.

Anthropic says it introduced a feature called preserved thinking with Claude Fable 5.1 and Claude Opus 5.5. For new API accounts created on or after August 31, 2026, the feature prevents users from editing Claude’s prior context in ways that could undermine protections around its reasoning.

The company says its safeguards have a false-positive rate below 0.1% for the relevant detection system. It also reports that it has updated its defenses against variations of extraction prompts, including attempts to obtain reasoning in another language or in specially formatted text.

These controls are designed to make it harder to collect protected reasoning traces while preserving normal access for legitimate users.

2. Detecting coordinated usage

Anthropic says its systems analyze patterns across requests and accounts to identify behavior consistent with distillation.

A single request for a detailed explanation may be legitimate. Thousands of closely related requests distributed across coordinated accounts can indicate a different purpose, especially when they repeatedly target a narrow set of advanced capabilities.

The company uses classifiers and behavioral fingerprinting to identify suspicious traffic. When it detects repeated attempts to extract protected information, it can impose stricter usage limits or ban associated accounts.

3. Raising the cost of repeated attempts

Anthropic says it has resumed charging for requests blocked by its safeguards in specific areas where the false-positive rate is below 0.1%, including distillation-related protections. The measure has applied since September 24, 2026, according to the company’s update.

The intention is to make large-scale attempts more expensive and less effective. Operators can no longer assume that every blocked extraction attempt will be cost-free.

Anthropic says the changes have involved trade-offs for its own business and customers, including turning away substantial volumes of traffic and requiring some legitimate users to update their integrations.

Why Competitors Might Want to Distill Claude

Advanced AI models are expensive to develop and operate. Training a frontier system requires substantial computing infrastructure, high-quality data, specialized researchers and repeated rounds of evaluation.

Distillation offers a way to transfer useful behavior from a stronger model to a smaller or separately trained system. In legitimate settings, it can make advanced capabilities more affordable and accessible.

Unauthorized distillation creates a different incentive. A company may seek to collect examples of sophisticated reasoning, coding, tool use or agentic behavior to improve its own model without independently reproducing every step of the original research.

Anthropic argues that this can allow competing laboratories to narrow capability gaps more quickly and at a lower cost. It has also raised concerns about what happens when capabilities are transferred into systems with different safeguards or deployment policies.

That concern should be separated from the broader question of whether AI models can learn from publicly available outputs. The technical ability to learn from an output does not by itself establish that a particular training activity is unlawful. The circumstances, access terms, applicable law and use of the resulting model all matter.

The Privacy Risks Behind Third-Party Model Routing

Anthropic’s September 2026 threat intelligence report raised another concern: some alleged distillation operations reportedly involved conversations originally submitted by users to other AI products.

The company said certain requests were relayed through third-party model-routing services, which forward prompts between users and AI providers. In the cases it described, the traffic allegedly included personal information, corporate data and other sensitive details.

Anthropic gave examples involving business financial forecasts and active software credentials. It said these exchanges could contain information belonging to users who had not knowingly consented to having their conversations used in another laboratory’s model-training pipeline.

These claims highlight a broader risk for developers and businesses that use third-party AI routers. Users may assume that their requests are handled only by the service they selected, while routing arrangements can introduce additional providers and data flows.

Organizations should therefore review the privacy policies and data-processing terms of AI services they use. Sensitive credentials should not be included in prompts unless absolutely necessary and handled through an appropriate secure mechanism. Businesses should also understand whether their requests may be logged, retained, forwarded or used for training.

Anthropic’s report presents its investigation into particular cases. It does not establish that all model-routing services engage in such practices.

Why This Matters for AI Competition

The allegations come as major AI companies compete on reasoning, coding, agentic capabilities and model efficiency.

A company that develops a strong model may invest heavily in research and infrastructure to produce capabilities that distinguish its products from competitors. If those capabilities can be copied at scale through unauthorized extraction, the economics of frontier AI development could change.

Companies may respond by limiting access to certain outputs, strengthening identity checks, monitoring traffic more closely or introducing different protections for their most capable models. Those measures could also affect legitimate customers who need detailed outputs for research, software development or other advanced work.

The challenge is to prevent abuse without making useful models unnecessarily difficult to access. Overly aggressive restrictions can create friction for genuine users, while weak controls can leave providers exposed to large-scale extraction.

This is likely to become an increasingly important issue as AI models improve and more businesses build products around them.

What the Distillation Dispute Means for Developers and Businesses

For companies building AI products, the controversy offers several practical lessons.

First, model access should be treated as a governed resource. Organizations using APIs should follow the provider’s terms and avoid patterns that could resemble automated extraction.

Second, developers should understand how their own data is handled. If a third-party service routes prompts through multiple providers, that arrangement may affect confidentiality, retention and compliance obligations.

Third, AI companies need to distinguish legitimate experimentation from suspicious traffic. Researchers, enterprise users and developers may have valid reasons to submit large volumes of requests. Effective safeguards should account for legitimate use while identifying coordinated efforts to bypass protections.

Finally, businesses should avoid assuming that every model with similar benchmark performance was developed in the same way. Distillation is one possible method of transferring capabilities, but model quality can also result from original research, training data, architecture choices and other techniques.

The Bigger Picture

Anthropic’s disclosures highlight a new front in AI competition: protecting not just model weights and training infrastructure, but also the capabilities revealed through normal interactions with a model. Large-scale extraction campaigns can use repeated API queries to gather valuable training examples, even without direct access to a provider’s internal systems.

The company’s latest safeguards reportedly make such operations significantly less effective, but Anthropic acknowledges that attackers may develop new techniques. The longer-term challenge is likely to involve ongoing adaptation by both AI providers and those seeking to extract capabilities. Clear access policies, robust technical controls and responsible data handling will all play a role.

Looking Ahead

The next important test will be whether Anthropic’s reported reduction in harvested data holds up as attackers change their methods. The company says it is monitoring for successful extraction attempts and updating protections when it identifies new techniques. Independent verification, clearer measures of effectiveness and transparent reporting would help the industry assess how much progress has been made without revealing details that would make future attacks easier.

For the broader AI sector, the dispute could accelerate changes in API access, account verification, reasoning protection and model-routing practices. Providers will need to balance intellectual-property protection with the needs of legitimate customers and researchers. The central question is whether the industry can make unauthorized capability extraction sufficiently difficult while keeping advanced AI useful, accessible and secure.

Frequently Asked Questions

1. What is an AI distillation attack?

It is an unauthorized effort to collect a model’s outputs at scale and use them to train or improve another AI system. Distillation itself is a legitimate training technique; the concern is extraction that violates access restrictions or other applicable rules.

2. Which AI companies has Anthropic accused of distillation?

In its February 2026 disclosure, Anthropic attributed campaigns to DeepSeek, Moonshot and MiniMax. Its September threat intelligence report described additional operations it attributed to seven China-based AI laboratories. These are Anthropic’s published findings and attributions.

3. How many exchanges were involved in the initial disclosure?

Anthropic said the three campaigns it identified in February generated more than 16 million exchanges through approximately 24,000 fraudulent accounts.

4. How effective are Anthropic’s new defenses?

Anthropic reported that its new safeguards reduced data harvested by distillers by around 90%–99% in early assessments. That is the company’s estimate, not an independently verified figure covering every possible attack.

5. What is preserved thinking?

It is a protection Anthropic introduced for Claude Fable 5.1 and Claude Opus 5.5 that prevents eligible new API accounts from editing prior context in ways that could expose protected reasoning transcripts.

6. Can distillation reproduce an entire AI model?

No. Distillation transfers useful behavior through training examples; it does not automatically reproduce the original model’s architecture, weights, training data or full capabilities. Results depend on the quality of the collected data and the training process.

7. Does this mean legitimate AI distillation is illegal?

No. Distillation is widely used to create smaller or more efficient models. Whether a particular activity is unauthorized or unlawful depends on the facts, applicable terms and relevant law.

8. Could these safeguards affect normal Claude users?

Potentially. Anthropic says some changes have required legitimate users to update integrations, and it acknowledges trade-offs. The company says its controls are designed to minimize disruption to ordinary usage.