Anthropic says it cut Claude distillation by up to 99%

The fight over copycat models just reached your integration.

Anthropic said on Oct. 12 that its new defenses have cut the data distillers harvest from Claude by around 90 to 99 percent, based on early evidence. Anthropic defines distillation attacks as "covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another." The prize is Claude's reasoning: the transcript of how it reaches an answer.

Anthropic named the labs it says did it

The company says it has banned tens of thousands of distillation-linked accounts, often within two hours of a campaign starting. The reasoning tokens distillers extract are now consistently 10 to more than 100 times lower than before, it says.

It also points at specific labs. Anthropic says Zhipu distilled the cyber capabilities of leading US models while developing GLM-5.3, then switched to an older Claude model and another lab's model once Claude's safeguards got in the way. It says requests to Moonshot's Kimi models were secretly forwarded to Claude, and that one user, believed to be affiliated with China's People's Liberation Army, sought to analyze CCTV surveillance of an individual.

Those are Anthropic's accusations. Its post carries no response from either company.

Why do labs bother? In one Anthropic test, summarizing the reasoning instead of showing it in full dropped a SWE-bench Verified score from 80.4% to 71.8%.

That gap is what the copycats are after.

Three defenses, and two of them touch you

Anthropic describes three layers.

First, it controls where reasoning can go. Preserved thinking, introduced with Claude Fable 5.1 and Claude Opus 5.5, prevents API accounts created on or after Aug. 31, 2026 from editing Claude's prior context. With Claude Sonnet 5.5, reasoning transcripts are visible only to the organization whose request produced them.

Second, a two-stage classifier now runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. Anthropic says its false positive rate is under 0.1%.

Third, accounts that keep trying to extract reasoning face stricter usage limits and bans. And since Sept. 24, Anthropic has charged for requests its safeguards block before Claude responds, in specific areas including distillation.

Check your account date, then your bill

Start with the date. If your API account is new since Aug. 31 and your code rewrites earlier turns of a conversation, to trim history or inject context, check it now. Anthropic says preserved thinking has required some developers to update their integrations. The post does not say whether older accounts are affected. Don't plan on being exempt forever.

Then the bill. A classifier wrong under 0.1% of the time is still sometimes wrong.

If you send a million requests a month, 0.1% is up to 1,000 calls.

Blocked calls are billed. Log the refusals that come back before any model output, and look for clusters on legitimate work. A pattern is something you can take to Anthropic. A hunch is not.

If you only use Claude in a chat app, none of this changes your day. It is aimed at the API, where the copying happens.

Expect the rules to keep moving

Anthropic says it expects distillation to remain a "cat-and-mouse game" and that its safeguards will keep changing. Expect more rules on how reasoning can be read and reused, and expect other labs to write their own.

Read the changelog before you blame your code.