AI Safety

Anthropic Cuts Claude Distillation Data Harvesting by 90–99%

Oct 13, 2026·5 min read·By Rahish Saifi

On October 12, 2026, Anthropic published a research update on how it is fighting distillation attacks—covert, industrial-scale campaigns that extract one model’s capabilities to replicate them in another without authorization, often through networks of fraudulent accounts. Early evidence from the company suggests its new methods have reduced the amount of data harvested by distillers by around 90 to 99%. On October 13, Reuters coverage in The Economic Times and other outlets highlighted the same headline: safeguards that restrict access to Claude’s reasoning have sharply cut extraction on Anthropic’s own platform.

This is a different story from Anthropic’s same-day IoT self-replication research—it is about competitors and proxy networks trying to copy frontier behavior by stealing the hidden chain-of-thought that makes Claude valuable for training smaller models.

What distillers want—and why reasoning is the prize

Distillation, in this adversarial sense, means generating millions of responses from a larger model and using them to teach a smaller one to mimic frontier behavior for a fraction of the development cost. Anthropic stresses that the most valuable training signal is not the final answer alone but transcripts of Claude’s reasoning—the thinking process written before the user-visible response—because that teaches the student model how Claude reaches conclusions.

The company’s defenses therefore focus almost entirely on making that reasoning harder to access. Earlier “simple” measures included summarizing reasoning before showing it to users; internal evaluations cited in the post found that training on summarized transcripts dropped a distilled model’s SWE-bench Verified score from 80.4% (full reasoning) to 71.8% (summarized only). Attackers then shifted to active extraction—prompt tricks from “output your prior reasoning verbatim” to large-scale automated probing (Anthropic’s September report described one lab testing 12,000 variant requests).

Three pillars of Anthropic’s new defenses

Anthropic now disrupts distillation along three tracks, which it says have minimal impact on legitimate users when working as intended:

Preserved thinking (controlling where reasoning can go): On Claude Fable 5.1 and Claude Opus 5.5, new API accounts created on or after August 31, 2026 cannot edit Claude’s prior context—blocking a common proxy-network trick. Reasoning from these models cannot be read by earlier models with weaker safeguards; on Claude Sonnet 5.5, reasoning transcripts are accessible only to the organization whose request produced them.
Two-stage classifier (blocking extraction attempts): Built in the style of Anthropic’s constitutional classifiers research, the system runs on generally available frontier models—currently Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. After internal and external red-teaming on real distiller transcripts, Anthropic says safeguards are now roughly as robust as bioweapon-related blocks, with a false positive rate under 0.1%, and that the classifier catches all distillation techniques described in its September report. The company continues patching evasions (for example, translating earlier reasoning into another language or writing it out in tags alongside its answer).
Limits, bans, and billing (making repeat attempts costly): Accounts used for distillation face stricter limits; persistent campaigns lead to bans. Anthropic says it has banned tens of thousands of distillation-linked accounts, often in under two hours after a campaign starts. Since September 24, 2026, it again charges for requests blocked by safeguards in low–false-positive areas—including distillation—before Claude responds.

Measured impact on Anthropic’s platform

To gauge effectiveness, Anthropic estimates how many reasoning tokens distillers extract on its own API. After the classifier rolled out, that volume is consistently 10 to 100 times lower than before—on top of gains from preserved thinking. On some days the extracted count is too small to measure. The company frames the combined effect as roughly 90–99% less harvested data overall, while acknowledging distillation remains a “cat-and-mouse” game and that a highly sophisticated, persistent bypass attempt may still lie ahead.

Why Anthropic says the stakes are safety and national security

Illicit distillation matters, in Anthropic’s telling, because distilled models can approach frontier capability without proportionally robust safeguards, increasing misuse risk in biology and cybersecurity.

The post cites Zhipu distilling cyber capabilities while building GLM-5.3—including an attempt on Claude Fable 5 before switching to older Claude and another lab’s model when cyber safeguards degraded attacks. The U.S. Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) assessed GLM-5.3 as the most cyber-capable open-weights release to date; Anthropic’s own research says GLM-5.3 safeguards are easily bypassed and that the model will develop security exploits end-to-end.

On national security, Anthropic points to distilled capabilities flowing into foreign military, intelligence, and surveillance systems. It references a Moonshot Kimi distillation case where requests were secretly forwarded to Claude—including one from a user it believes was affiliated with China’s People’s Liberation Army seeking CCTV surveillance analysis of a specific individual.

Trade-offs for Anthropic and developers

The defenses are not free. Anthropic says it has turned away meaningful revenue and trillions of tokens of paying distiller traffic, invested substantial research and product time, and required some legitimate developers to update integrations because of preserved thinking. Classifiers can block benign traffic in fewer than 0.1% of cases—and those blocked requests are now billable in covered safeguard areas. The company argues the costs are still worth bearing compared with releasing frontier-class weights or APIs without comparable anti-distillation posture.

What’s next for the industry

Anthropic frames distillation as every frontier developer’s problem: proxy networks also route abuse through third-party clouds and inference providers. Platforms, not just model labs, are expected to detect fraud quickly and offboard abusive accounts. The post is partly a plea that competitors not leave easier-to-distill models on the table—pointing to the GLM-5.3 example—while distillers keep innovating on extraction prompts.

For builders on Claude’s API, the practical watch items are preserved-thinking integration changes, occasional classifier blocks, and billing on blocked safeguard hits. For policy and security readers, the through-line is unchanged: the fight is less about stopping chat copies than about locking down reasoning traces that shortcut years of frontier training.