Anthropic says new defenses cut distillation of Claude’s reasoning by 90% to 99%

Anthropic said in a research post published on October 12, 2026 that defenses introduced in recent months have reduced the amount of data harvested by distillation attackers from Claude by around 90% to 99%.

What distillation attacks are

Anthropic describes distillation attacks as covert, industrial-scale campaigns to extract one model's capabilities and replicate them in another without authorization, often using networks of fraudulent accounts. The most valuable data for attackers is Claude's reasoning — the thinking it writes out before answering.

The company gave two reasons for concern. First, distilled models can approach frontier capability without proportionally robust safeguards, creating risks in biology and cybersecurity. Anthropic said Zhipu distilled the cyber capabilities of leading U.S. models while developing GLM-5.3. Second, it called illicit distillation a national-security risk, citing a case in which requests to Moonshot's Kimi models were secretly forwarded to Claude — including one seeking to analyze CCTV surveillance of a specific individual.

Three layers of defense

• Controlling where reasoning can go. With Claude Fable 5.1 and Claude Opus 5.5, Anthropic introduced "preserved thinking," preventing API accounts created on or after August 31, 2026 from editing Claude's prior context.
• Blocking extraction attempts. A two-stage classifier, modeled on its constitutional classifiers research, now runs on its most capable generally available models. Anthropic says it is roughly as robust as its bioweapons safeguards, with a false-positive rate below 0.1%.
• Making repeated attempts difficult. Persistent offenders face stricter usage limits and account bans.

Since the classifier was introduced, reasoning tokens extracted by distillers have been consistently 10 to 100 times lower, Anthropic said, and it has banned tens of thousands of accounts, often within two hours of a campaign starting.

Trade-offs and a call to the industry

Anthropic acknowledged costs: some developers had to update integrations, fewer than 0.1% of benign requests may be blocked, and the company now charges for requests blocked before Claude responds in those areas. It said it does not yet know how long the gains will last and urged other developers and platforms to adopt similar protections, a point also highlighted by The Decoder.

---

Sources: Anthropic, The Decoder.