Anthropic says new Claude defenses cut distillation data harvest by 90–99%

Anthropic said on 12 October 2026 that new defenses against distillation attacks on Claude have cut the amount of reasoning data harvestable by attackers by roughly 90 to 99 percent, according to the company’s own measurements on its platform.

What distillation is

Distillation campaigns use networks of fraudulent accounts to extract a frontier model’s capabilities — especially its hidden reasoning transcripts — and train a cheaper copy. Anthropic argues illicit copies can ship with weaker safeguards and can feed foreign military or surveillance systems. It cites Zhipu’s GLM-5.3 as an example of cyber capabilities obtained partly through distillation, and a case in which Moonshot’s Kimi traffic included a request Anthropic links to CCTV analysis tied to China’s People’s Liberation Army.

New defenses

Anthropic says it now disrupts attacks three ways: preserved thinking that stops newer API accounts from editing prior context; a two-stage classifier (false-positive rate under 0.1%) that blocks extraction attempts on Sonnet 5.5, Opus 5/5.5 and Fable 5/5.1; and stricter limits plus bans, including charging for blocked high-confidence distillation requests since 24 September. Early summarization of reasoning already cut a distilled model’s SWE-bench Verified score from 80.4% to 71.8% in Anthropic’s tests.

Caveats

The figures are Anthropic’s internal estimates; the company expects attackers to keep adapting and notes trade-offs for legitimate developers (integration updates, rare false blocks). It urges other labs and cloud platforms to disrupt fraudulent traffic as well.