Anthropic says it has sharply reduced how much data rival AI labs can secretly pull out of Claude to train copycat models. In a new research post, the company reports that its latest defenses have cut the data harvested by these “distillers” by around 90 to 99%. The changes come with some costs, though, including a few extra hoops for legitimate developers.
Here is how distillation works, what Anthropic changed, and what it means if you build on Claude.
What Is a Distillation Attack?
Distillation means using a strong AI model’s answers to train a smaller model to act like it. Anthropic calls it an attack when it is done covertly, at industrial scale, and without permission, often through networks of fake accounts.
The most valuable target is Claude’s reasoning, the step-by-step thinking it writes before giving an answer. That thinking teaches a copycat model how Claude gets to its answers, not just what the answers are.
Why Anthropic Cares
Anthropic gives two main reasons. First, copied models often ship without strong safety guardrails, which raises risks in areas like biology and cybersecurity. Second, the company argues that distilled capabilities can end up in foreign military and surveillance systems.
The post names Chinese lab Zhipu, saying it distilled cyber skills from leading US models while building GLM-5.3. Anthropic also says requests sent to Moonshot’s Kimi models were secretly forwarded to Claude, including one from a user it believes was tied to China’s People’s Liberation Army.
How the Attacks Evolved
Anthropic’s first fix was simple: show users a summary of Claude’s reasoning instead of the full text. In its tests, a model trained on full Claude Opus 4.8 transcripts scored 80.4% on the SWE-bench Verified coding benchmark, versus 71.8% when trained on summaries only.
Distillers then got more aggressive. They tried prompts asking Claude to repeat its hidden reasoning word for word, and one lab tested 12,000 different trick requests. Some proxy networks ran hundreds of thousands of fake accounts, and one managed more than 20,000 at once.
Anthropic’s New Defenses
The company describes three main layers of protection.
| Defense | How It Works |
|---|---|
| Preserved thinking | New API accounts created on or after August 31, 2026 cannot edit Claude’s prior context on Fable 5.1 and Opus 5.5 |
| Locked-down reasoning | On Sonnet 5.5, reasoning transcripts are visible only to the organization that made the request |
| Two-stage classifier | Detects extraction attempts with a false positive rate under 0.1% |
| Account penalties | Stricter limits for repeat offenders, plus bans, often within two hours |
Anthropic says the classifier is now about as robust as the safeguards that stop Claude from helping with bioweapons. It runs on Claude Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. The company also patches new tricks quickly, such as asking Claude to translate its earlier reasoning into another language.
The Results So Far
According to Anthropic, the amount of reasoning distillers extract is now consistently 10 to 100 times lower than before the classifier launched. It has banned tens of thousands of accounts linked to distillation.
- The classifier catches every technique described in Anthropic’s September report.
- Anthropic says it has turned away meaningful revenue and trillions of tokens of paying traffic.
- The company admits it has not yet faced a highly sophisticated, persistent effort to beat the new system.
Anthropic frames this as a cat-and-mouse game. Today’s gains are real, but the company expects attackers to keep adapting.
This post lands during a busy stretch of Anthropic safety disclosures, including a recent case where a Claude test model sent a false police tip during an evaluation.
What This Means for You
For most people who chat with Claude AI every day, nothing changes. Developers, however, may notice a few differences.
- If you use the API with an account created on or after August 31, 2026, you cannot edit Claude’s earlier context on the newest models, so check your integration.
- Since September 24, Anthropic charges for requests its safeguards block before Claude responds, in areas where false positives are below 0.1%.
- Avoid prompts that ask Claude to reveal or repeat its hidden reasoning, since these can trigger the classifier and stricter limits.
- If you build AI agent tools on Claude, test your workflows against the newer models before switching.
Developers working in the terminal may also want our tips on how to stop Claude Code prompts from interrupting their work. You can find more updates in our AI news section.
Sources
This article is based on Anthropic’s research post on Anthropic Research.
Conclusion
Anthropic is treating model copying as a serious safety and national security problem, not just a business issue. Its new mix of preserved thinking, classifiers, and fast bans has reportedly cut harvested data by 90 to 99%. The trade-off is a slightly stricter experience for some developers, including charges for blocked requests. Anthropic is also calling on other AI labs to adopt similar defenses so copycats cannot simply turn elsewhere. Whether this holds up against a determined, well-funded attacker is the big question for the months ahead.
