Anthropic Says New Claude Defenses Cut Distillation Up to 99%

Anthropic says a new set of safeguards has slashed the amount of data that rival labs can siphon out of Claude by roughly 90 to 99%. The company detailed the defenses in a research post on October 12, and said it has banned tens of thousands of accounts tied to the activity, often within two hours.

The fight is over distillation, and it goes beyond business. Anthropic argues that copied models can end up with frontier-level skills but none of the safety guardrails.

What distillation is

Distillation is a way to train a cheaper model by feeding it the outputs of a stronger one. Used on your own models, it's a standard technique.

Anthropic is targeting something different: what it calls "covert, industrial-scale campaigns to extract the capabilities of one model" to build another without permission. These campaigns typically run through networks of fraudulent accounts that hammer the API with carefully designed prompts and collect the answers.

Anthropic has been publicly raising alarms about this for most of 2026. This post is the first detailed look at what it's doing to stop it.

Why Anthropic says it's a safety issue

The company gave two pointed examples.

First, it says Zhipu distilled cyber capabilities while developing its GLM-5.3 model. When Claude's cyber safeguards degraded those attempts, Zhipu reportedly switched to an older Claude model and another lab's model. The U.S. Center for AI Standards and Innovation (CAISI) later assessed GLM-5.3 as the most cyber-capable open-weights model released to date.

Second, Anthropic says requests to Moonshot's Kimi models were secretly forwarded to Claude. One user, believed to be affiliated with China's People's Liberation Army, sought help analyzing CCTV surveillance of a specific individual.

Why this matters: if safety training can be bypassed simply by copying a model's answers, then guardrails at one lab only protect as far as the copies don't spread.

How the new defenses work

Anthropic describes four layers.

Summarized reasoning. Instead of showing the model's full step-by-step thinking, Claude returns summaries. Anthropic says a model trained on summaries scored 71.8% on SWE-bench Verified, versus 80.4% when trained on full transcripts. Less detail means less to steal.

Preserved thinking. For API accounts created on or after August 31, 2026, users can't edit prior context in a conversation. That blocks a common trick where attackers rewrite earlier turns to coax out more reasoning.

A two-stage classifier. Modeled on Anthropic's constitutional classifiers (AI filters trained to spot specific misuse), it flags distillation traffic. Anthropic says it has a false positive rate below 0.1%.

Account enforcement. Repeat offenders face tighter usage limits and bans. Since September 24, Anthropic has also charged for requests blocked by safeguards in certain areas, including distillation.

The results

Anthropic reports early evidence that harvested data fell by roughly 90 to 99%. Reasoning tokens extracted by distillers dropped by a factor of 10 to more than 100.

The cost was real. Anthropic says it turned away meaningful revenue and large volumes of paying traffic, and some legitimate developers had to update their integrations.

Who this affects

Developers on the Claude API with accounts created after August 31 should check whether their apps edit earlier conversation turns. If they do, they'll need to adjust.

Rival labs that relied on Claude outputs for training data now face a much harder, more expensive target.

Policymakers get fresh ammunition in the debate over export controls and model security, especially the claims about Zhipu and Moonshot.

What the industry is saying

Anthropic is careful not to declare victory. It calls distillation a "cat-and-mouse game" and says it hasn't yet faced a highly sophisticated, persistent attempt to get around the new defenses.

It also argues the problem can't be solved by one company. Other model developers, cloud providers, and inference platforms need similar protections, or distillers will simply move to the weakest link.

What's next

Watch for responses from the named labs, and for whether OpenAI, Google, and cloud platforms adopt similar measures.

Also watch for false positives. A sub-0.1% error rate sounds tiny, but at Claude's scale it still means some legitimate requests get blocked and billed.

The bottom line

Anthropic is treating model copying as a security threat, not just a business problem, and it's willing to lose revenue to fight it. If you build on Claude, review how your app handles conversation history. If you follow AI policy, this is a sign that protecting model outputs is becoming as important as protecting model weights.