Anthropic says it has cut data extraction via illicit distillation of Claude by 90% to 99%

Anthropic has published (October 12, 2026) an article on how it has strengthened its defenses against distillation attacks. According to the company, the new measures have reduced the amount of data obtained by distillers by around 90-99%. This is the company's own figure, described as 'early evidence', and the text acknowledges that a highly sophisticated and persistent attempt to circumvent the defenses has not yet been seen.

Illicit distillation is defined as covert, industrial-scale campaigns to extract a model's capabilities and replicate them in another without its developers' authorization, often through networks of fraudulent accounts. Anthropic argues that it makes it possible to imitate frontier capabilities at a fraction of the time and cost, and that it has been widely used by foreign labs to keep pace with US companies.

The company sets out two concerns. The first: distilled models can approach the capability frontier without proportionally robust safeguards, posing risks in biology and cybersecurity. It cites the case of Zhipu, which according to Anthropic distilled cyber capabilities from US models for GLM-5.3; it tried to distill Claude Fable 5, but upon finding that the cyber safeguards degraded its attacks, it switched to an older Claude model and to another lab's model. According to the article, the US agency CAISSI considers GLM-5.3 the most cyber-capable open-weight model released to date, and Anthropic's own research states that its safeguards can be easily bypassed. The second: a national security risk, as these capabilities would be integrated into military, intelligence and surveillance systems. It mentions a case in which requests to Moonshot's Kimi models were secretly forwarded to Claude, including one from a user Anthropic believes to be affiliated with China's People's Liberation Army, who was seeking to analyze CCTV footage of a specific individual.

The core of the defense is protecting Claude's reasoning, the most valuable data for training a smaller model. The first measure was to summarize the reasoning before displaying it. In its tests, a pretrained model reached 80.4% on SWE-bench Verified when trained on full Claude Opus 4.8 transcripts, and 71.8% on the summarized ones. Attackers then turned to active extraction: from asking Claude to reproduce its reasoning verbatim to one lab that tested 12,000 different requests. They also built proxy networks with hundreds of thousands of fraudulent accounts; a February report described a network with more than 20,000 simultaneous accounts, using fake identities and stolen payment details.

The new defenses operate on three fronts. First, controlling where reasoning can go: with Claude Fable 5.1 and Claude Opus 5.5, 'preserved thinking' is introduced, which prevents new API accounts (created since August 31, 2026) from editing Claude's prior context; earlier models with weaker safeguards are prevented from reading that reasoning; and with Claude Sonnet 5.5, reasoning transcripts are only accessible to the organization that originated the request. Second, blocking and patching extraction attempts through a two-stage classifier similar to 'constitutional classifiers', subjected to internal and external red-teaming; according to Anthropic, it is nearly as robust as the safeguards against biological weapons and has a false positive rate below 0.1%. It applies to Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. Techniques such as asking for the reasoning to be translated into another language or written between tags have already been shut down. Third, making repeated attempts harder: stricter usage limits, blocking persistent accounts and, since September 24, charging for blocked requests before Claude responds in areas with false positive rates below 0.1%.

On results, Anthropic says the classifier detects all the techniques described in its September report and that extracted reasoning tokens are 10 to 100 times fewer than before (on some days, too few to measure). It has banned tens of thousands of accounts associated with distillation, often within less than two hours of a campaign starting.

The company acknowledges costs: it has turned down significant revenue and trillions of tokens of paid traffic from distillers, some developers have had to update their integrations, and the classifiers may block legitimate requests in fewer than 0.1% of cases, which are now charged. It expects a cat-and-mouse game and does not know how long the improvements will last.

Finally, Anthropic stresses that this is an industry-wide problem: distillers spread traffic across its API, third-party cloud platforms and other providers, so platforms must detect abuse and shut down fraudulent accounts. It acknowledges that incentives often run the other way, because defenses are expensive and distillers remain paying customers, and says it is publishing its methods to show that a viable alternative exists.