What Anthropic Says The Defences Achieved
Anthropic published its anti-distillation results on 12 October and says early evidence points to a 90 to 99 percent drop in the data distillers harvest from Claude. In its words, distillation is a covert, industrial-scale campaign to copy one model's capabilities into another, often through networks of fraudulent accounts.
The company counts progress in reasoning tokens, the thinking Claude writes before it answers. Since its new classifier went live, the reasoning tokens distillers extract are consistently 10 to 100 times lower, and on some days too few to measure. Tens of thousands of linked accounts have been banned, often less than two hours after a campaign began. The classifier catches every technique in Anthropic's September report. Reuters reported the same figures and notes that Z.ai did not immediately respond to a request for comment.
Anthropic puts two limits on its own claim. It doesn't know how long the gains will last, and it hasn't yet seen a highly sophisticated, persistent attempt to get round the defences.
Why Reasoning Transcripts Are The Prize
Reasoning transcripts are the most valuable thing a distiller can collect, because they show a smaller model how a larger one reaches its answer. Anthropic tested this: a model trained on full Claude Opus 4.8 reasoning scored 80.4 percent on SWE-bench Verified, against 71.8 percent when trained on summarised reasoning, a gap of 8.6 points.
That gap explains the effort on both sides. Anthropic says one lab tested 12,000 different requests to trick Claude into revealing its reasoning, and proxy networks controlling hundreds of thousands of fraudulent accounts spread the attempts. One network ran more than 20,000 accounts at once. Anthropic names Zhipu, which it says distilled the cyber capabilities of leading US models while building GLM-5.3, and Moonshot, whose Kimi requests it says were secretly forwarded to Claude. These are Anthropic's allegations. Z.ai had not responded when Reuters published, and the sources we read carry no reply from Moonshot.
What The Defences Cost A Paying Customer
Anthropic is open that its defences aren't free for legitimate users. The table sets each defence against what it costs a paying customer.
| Defence | What it stops | Cost to a legitimate customer |
|---|---|---|
| Preserved thinking on Fable 5.1 and Opus 5.5 | Proxy accounts editing Claude's prior context to pull out reasoning | Accounts created from 31 August 2026 cannot edit prior context, and some developers had to update integrations |
| Reasoning access limits on Sonnet 5.5 | Others reading a request's reasoning transcript | Transcripts are readable only by the organisation whose request produced them, and Anthropic lists no cost |
| Two-stage classifier | Requests that try to extract hidden reasoning | Fewer than 0.1 percent of benign requests blocked, and blocked requests billed since 24 September |
| Stricter limits and bans | Repeated, persistent extraction | Anthropic lists none, since it targets accounts that keep trying to extract reasoning |
The classifier runs on Anthropic's most capable generally available models: currently Claude Sonnet 5.5, Opus 5, Opus 5.5, Fable 5 and Fable 5.1.
The Small Print On Blocked Requests
Since 24 September Anthropic has charged again for requests its safeguards block before Claude responds, in the areas where it measures a false-positive rate below 0.1 percent, and distillation is one of them.
Anthropic gives no price per blocked request and no count, so the exposure is yours to estimate. If your team sends 200,000 benign requests a month and the true rate sat right at the 0.1 percent ceiling, up to 200 would be blocked and billed. The post states a ceiling, not an average, so log blocked requests for a month to learn your own. A product that asks Claude to repeat, translate or tag its earlier reasoning resembles the techniques Anthropic says it now blocks.
Three Checks To Run With Your Vendor
Anyone who builds on Claude should check three things with Anthropic or with the platform that resells it.
First, check whether your integration edits prior context or reads reasoning outside the organisation that produced it. Second, log blocked requests and put a price on them. Third, if you reach Claude through a cloud platform or reseller, ask that provider how it detects abuse and whether blocked requests are billed to you.
Anthropic says distillers spread traffic across its API, third-party cloud platforms and other inference providers, and that platforms have a role in detecting abuse and offboarding fraudulent accounts. How your provider does that isn't something the post tells us.
Read next: Your Cybersecurity Prompts Just Got Quietly Rerouted | OpenAI Priced Its Model at Half of Anthropic's
