Anthropic has introduced stronger security measures to prevent rival developers from extracting the capabilities of its Claude artificial intelligence models through large-scale distillation attacks. The company says the new defenses have reduced the amount of reasoning data harvested from its most capable models by 90% to 99%, making it more difficult for unauthorized users to reproduce their behavior. The measures include restricting access to internal reasoning, detecting suspicious prompts, limiting repeated extraction attempts and banning accounts associated with coordinated campaigns.
The announcement comes as competition intensifies among companies developing advanced AI models. Model distillation can help developers create smaller, cheaper systems that imitate the capabilities of a more powerful model, reducing the time and computing resources required to develop competitive products. Anthropic argues that unauthorized distillation can undermine its research investment and potentially transfer advanced capabilities to models that lack comparable safety protections. However, the company acknowledges that the contest is ongoing and that attackers may develop new techniques to bypass its defenses.
Key Takeaways
- Up to 99% reduction: Anthropic says its new defenses have reduced the reasoning data extracted by distillers by approximately 90% to 99%.
- Advanced detection: A two-stage classifier system identifies requests that appear designed to extract protected reasoning.
- Reasoning protection: New restrictions limit the ability to manipulate, transfer or retrieve protected reasoning transcripts.
- Account enforcement: Anthropic says it has banned tens of thousands of accounts associated with suspected distillation campaigns.
- False-positive rate: The company reports a false-positive rate below 0.1% for its new classifier safeguards.
- Commercial impact: Anthropic says it has rejected substantial revenue and trillions of tokens of traffic associated with suspected distillers.
- Industry-wide challenge: The company says AI developers and cloud platforms must work together to identify and disrupt unauthorized extraction attempts.
- No permanent solution yet: Anthropic expects attackers to keep adapting their methods and says its defenses will require continuous improvement.
What Is AI Model Distillation?
AI model distillation is a training technique in which a smaller or less capable model learns from the outputs of a more capable model. The objective is to reproduce some of the teacher model’s behavior without necessarily repeating the full training process used to build it.
For example, a developer can submit questions to a powerful AI system, collect its responses and use those examples to train another model. With enough carefully selected examples, the smaller model may learn useful patterns in reasoning, coding, mathematics and language generation.
Distillation is not inherently unauthorized or harmful. AI developers routinely use teacher-student training methods to make models smaller, faster and less expensive to operate. Companies may also distill their own models or use outputs under an appropriate license.
The concern raised by Anthropic is unauthorized extraction at industrial scale. In these cases, a developer allegedly uses another company’s commercial model to collect valuable training data without permission, potentially recreating parts of its capabilities while avoiding much of the original development cost.
Anthropic says such campaigns can involve large networks of accounts and automated requests. Attackers may attempt to extract particularly valuable information, including detailed reasoning transcripts, rather than simply collecting ordinary answers.
The distinction matters because a model’s final answer may contain less information about how it solved a problem than a detailed reasoning transcript. According to Anthropic, access to richer reasoning data can make distillation more effective.
Why Anthropic Says Its New Defenses Matter
Building a frontier AI model requires substantial investment in research, computing infrastructure, data preparation, engineering and safety testing. Unauthorized distillation could allow another developer to reproduce selected capabilities without bearing the same development costs.
Anthropic argues that this creates two principal risks.
First, unauthorized extraction can undermine the commercial value of its models. If a rival can train a competing model using extensive outputs from Claude, it may be able to offer similar capabilities at a lower cost or bring a competing product to market more quickly.
Second, Anthropic says distillation can transfer capabilities into models that have not undergone equivalent safety evaluations. A smaller model might learn sophisticated coding or other technical skills without necessarily inheriting the safeguards and operational controls of the original system.
These concerns are particularly relevant when models can assist with cybersecurity, scientific research and other technically demanding activities.
However, distillation does not automatically reproduce every capability of the original model. The quality of the resulting system depends on the training data, architecture, optimization process and other development choices. A model trained on another system’s outputs may imitate selected behaviors while remaining weaker in other areas.
Anthropic’s argument is therefore that unauthorized distillation can reduce the cost of acquiring certain capabilities and potentially weaken the relationship between capability development and safety evaluation.
How Anthropic Is Blocking Distillation Attacks
Anthropic’s October 12 research update describes three broad defensive strategies: restricting access to protected reasoning, detecting extraction attempts and making repeated attacks more difficult.
1. Restricting Access to Protected Reasoning
One of Anthropic’s earlier defenses involved summarizing Claude’s reasoning before presenting it to users. The company said its experiments showed that detailed reasoning transcripts were more useful for training a distilled model than summarized versions.
In an evaluation using SWE-bench Verified, Anthropic reported that a pretrained model trained on full transcripts from Claude Opus 4.8 achieved a score of 80.4%. A version trained on summarized transcripts scored 71.8%.
The result suggests that reducing the detail in training examples can affect the performance of a distilled model. However, the benchmark measures performance in a particular coding evaluation, and the result should not be interpreted as a universal measure of distillation effectiveness.
Attackers subsequently attempted to bypass these protections by asking Claude to reveal its earlier reasoning verbatim or by manipulating conversation context.
Anthropic says it has responded with additional restrictions, including a feature called preserved thinking for selected models. The measure prevents certain newer API accounts from editing Claude’s prior context, making it harder to manipulate reasoning transcripts across conversations.
The company has also restricted access to reasoning between models and accounts. For Claude Sonnet 5.5, Anthropic says reasoning transcripts are accessible only to the organization whose request generated them.
These measures are intended to prevent attackers from using one account or model to obtain information protected by another.
2. Using Automated Classifiers to Detect Extraction Attempts
Anthropic has developed a two-stage classifier system to identify requests that appear designed to extract protected reasoning.
A classifier is a system that analyzes an input and assigns it to a category. In this case, the safeguards are intended to distinguish ordinary requests from prompts that attempt to obtain detailed internal reasoning for model training.
Anthropic says the system was developed using transcripts of suspected extraction attempts. The company also conducted internal and external red-team evaluations to identify weaknesses and improve the defenses.
The system is now used with selected capable Claude models, including Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1, according to the company’s report.
Anthropic says its safeguards are roughly as robust as those used to prevent Claude from assisting with biological weapons development. It also reports a false-positive rate below 0.1%.
A false positive occurs when a legitimate request is incorrectly flagged as suspicious. Even a low rate can matter when a service processes enormous volumes of requests, so the company must balance security with usability.
Anthropic acknowledges that the safeguards can occasionally block legitimate users and that some developers have needed to update their integrations to comply with the revised restrictions.
3. Limiting Repeated Attempts and Banning Accounts
The third strategy focuses on identifying coordinated activity and making it more difficult for attackers to repeat unsuccessful attempts.
Anthropic says suspected distillation campaigns have used networks of fraudulent accounts, including accounts created with false identities or stolen payment details. Such networks can distribute requests across many accounts to avoid detection or continue operating after individual accounts are blocked.
The company says it applies stricter usage limits to accounts that repeatedly attempt to extract protected reasoning. When it identifies persistent distillation activity, it can ban the associated accounts.
Anthropic also resumed charging for certain requests blocked by its safeguards on September 24, 2026, in areas where its false-positive rate is below 0.1%. The policy is intended to make large-scale probing more expensive while allowing the company to enforce its security controls.
The company reports that it has banned tens of thousands of accounts associated with distillation activity, often within two hours of a campaign beginning.
These measures increase the operational cost of suspected extraction campaigns, although determined attackers may still attempt to create new accounts, change their prompts or distribute traffic across other providers.
Anthropic Reports a 90% to 99% Reduction in Extracted Data
The headline figure in Anthropic’s announcement comes from its measurements of reasoning tokens extracted through its own platform.
The company says that after the new classifier was introduced, the volume of reasoning tokens extracted by distillers became consistently 10 to 100 times lower than before. A reduction by that factor corresponds to approximately 90% to 99% or more, depending on the comparison.
| Measurement | Anthropic’s reported result |
|---|---|
| Reduction in extracted reasoning data | Approximately 90%–99% |
| Relative reduction in some measurements | 10 to 100 times lower |
| Reported classifier false-positive rate | Below 0.1% |
| Accounts associated with distillation banned | Tens of thousands |
| Reported enforcement speed | Often within two hours of a campaign starting |
| Long-term effectiveness | Not yet established |
Source: Anthropic’s October 12, 2026, research update.
The numbers require context. They describe the reduction in reasoning data that Anthropic estimates distillers were able to extract through its platform after the new protections were implemented.
They do not establish that all unauthorized distillation has stopped, that every competitor has been prevented from learning from Claude’s outputs, or that the same reduction applies to extraction attempts conducted through other providers.
Anthropic also acknowledges that it has not yet observed a highly sophisticated and persistent attempt to circumvent the new defenses. The company expects that its systems will need continued updates as attackers adapt.
The results are therefore evidence of improved resistance under the company’s measurements, rather than proof of a permanent solution.
The Role of Chinese AI Companies in the Distillation Debate
Anthropic has linked its concerns about unauthorized distillation to international competition in advanced AI.
In its research update, the company discussed suspected extraction efforts involving large networks of accounts and referenced Zhipu, also known as Z.ai, in connection with concerns about distillation involving the GLM model family.
Anthropic has argued that distillation can help overseas AI laboratories acquire advanced capabilities more quickly. These are the company’s allegations and interpretation of the competitive landscape; they should not be treated as independent proof that every company using distillation has acted improperly.
The broader debate involves a distinction between legitimate technical methods and unauthorized use of a proprietary model. Distillation is a standard machine-learning technique, and developers can use it on their own models or with properly licensed training data.
The controversy arises when developers allegedly use covert or fraudulent methods to extract protected information from a competitor’s service.
Anthropic says it has observed attempts to use proxy networks, false accounts and other methods to access Claude at scale. Such activity can raise concerns about intellectual property, platform abuse and the transfer of capabilities into models with different safety protections.
The company has called for other model developers and cloud platforms to strengthen their defenses, arguing that a single provider’s safeguards can be undermined if similar models remain accessible through less-protected services.
What the New Defenses Mean for AI Developers
Anthropic’s changes may affect developers who rely on Claude’s API, particularly those using conversation histories, model outputs or structured reasoning in their integrations.
The company says some users have needed to update their software to accommodate preserved-thinking restrictions. Legitimate developers may also occasionally encounter blocked requests if their prompts resemble extraction attempts.
For businesses, the announcement highlights the importance of designing AI integrations around supported interfaces rather than relying on access to internal reasoning transcripts.
Developers can reduce disruption by reviewing API documentation, preserving required context in supported formats and avoiding attempts to retrieve hidden reasoning that is not intended to be exposed.
The changes also illustrate a broader challenge for AI platforms: security measures must distinguish legitimate automation from large-scale abuse without unnecessarily limiting normal use.
Anthropic says its classifiers have a low false-positive rate, but the practical impact will depend on how those controls perform across different applications, regions and request patterns.
For AI companies, the announcement is a reminder that protecting a model involves more than securing its weights and training infrastructure. The API itself can become a channel through which competitors attempt to gather valuable training data.
The Bigger Picture
Anthropic’s new safeguards highlight a growing tension in the AI industry between the benefits of model distillation and the protection of proprietary capabilities. Distillation can make AI systems cheaper and more efficient, but unauthorized extraction can allow developers to benefit from another company’s research without permission. By restricting reasoning access, deploying classifiers and enforcing account-level limits, Anthropic is attempting to make large-scale extraction more difficult.
The reported 90% to 99% reduction is significant as a company-reported security result, but it does not end the broader debate. Attackers may change their techniques, and other AI platforms may have different safeguards. The long-term outcome will depend on whether model providers can maintain effective defenses without imposing excessive costs on legitimate developers and users.
Looking Ahead
Anthropic says it will continue monitoring for new extraction methods and updating its classifiers as attackers adapt. The company also wants other AI developers and infrastructure platforms to adopt stronger protections, arguing that distillation campaigns can move between APIs, cloud services and third-party inference providers. Future evidence will be needed to determine whether the reported reduction remains effective against more sophisticated and persistent attempts.
For the AI industry, the issue is likely to become increasingly important as frontier models become more valuable and the cost of reproducing selected capabilities falls. Providers will need to decide how much model behavior to expose, how to support legitimate research and integration, and how to identify abuse without blocking ordinary work. Anthropic’s latest measures provide one example of how companies are trying to protect their technology while keeping their AI services available to customers.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
