On 12 October 2026 Anthropic published a technical note detailing its defences against distillation attacks — industrial-scale campaigns to copy one model's capabilities and transplant them into another without permission — and claims the measures have cut by 90 to 99 per cent the volume of data such groups manage to pull out of Claude. The piece, Strengthening our defenses against distillation attacks, also spells out the price: legitimate customers who have had to rework their integrations, and paying traffic turned down.
What was announced
The material worth most to a distiller is not Claude's final answer but the chain of reasoning it writes before replying: it teaches the smaller model how the conclusion is reached, not just what it is. So almost the entire defence rests on one idea — make that reasoning hard to reach.
The company describes three fronts.
Controlling where reasoning can travel. Claude Fable 5.1 and Claude Opus 5.5 brought what Anthropic calls preserved thinking: API accounts created on or after 31 August 2026 cannot alter Claude's prior context. The aim is to stop a network of disposable accounts from reinjecting protected thinking blocks from one conversation into another to convince the model it already holds them and may repeat them. Two further locks go with it: those models no longer let earlier, weaker-guarded versions read their reasoning, and on Claude Sonnet 5.5 a transcript is reachable only by the organisation that produced it.
Catching and patching extraction attempts. Anthropic says it built a two-stage classifier, from the same family as its constitutional classifiers, trained on real transcripts of extraction attempts and put through internal and external red teaming. According to the company, the resulting robustness is comparable to the barriers that stop Claude helping build bioweapons, with a false positive rate under 0.1 per cent. It runs on the most capable generally available models — Sonnet 5.5, Opus 5 and 5.5, Fable 5 and 5.1 — and is meant to cover future ones. Recent tricks it has had to close off include asking Claude for its earlier reasoning rendered in another language, or demanding it tagged alongside the answer.
Making persistence expensive. Anyone who keeps retrying runs into tighter usage limits and, if the pattern holds, account closure. Anthropic says it has banned tens of thousands of accounts linked to distillation, often within two hours of a campaign starting. And since 24 September it once again bills requests that safeguards stop before the model replies, only in the areas where false positives stay below that 0.1 per cent.
The headline result: after the classifier went live, reasoning tokens extracted on its own platform consistently sit 10 to 100 times below the previous period, and on some days the volume is too small to measure.
Where it comes from
The first countermeasure was far simpler: summarise the reasoning before showing it. To gauge how much that hurt a distiller, Anthropic trained an in-house model on transcripts from Claude Opus 4.8 and ran SWE-bench Verified: with full reasoning it scored 80.4 per cent; with the summarised version, 71.8 per cent.
Attackers responded by moving from passive harvesting to active extraction, pushing the model to hand over the whole chain. Tactics range from ordering it to repeat its previous reasoning character by character to one lab that, per the note, tested twelve thousand different formulations. Then came scale: proxy networks with hundreds of thousands of fraudulent accounts, fake identities, stolen payment details and resold access in countries where Claude is not sold. A February report from the company cited a single network running more than 20,000 accounts at once.
Anthropic justifies the effort with two cases. First, Zhipu: it says the firm distilled cyber capabilities from leading US models while building GLM-5.3, tried it on Claude Fable 5, and — finding its attacks degraded by the cyber safeguards — fell back to an older Claude and to another lab's model. The US body CAISSI has since rated GLM-5.3 the most cyber-capable open-weights model released so far, and Anthropic adds that its own testing found guardrails that give way easily and a willingness to build exploits end to end. The second case involves Moonshot's Kimi models, whose requests were, according to Anthropic, quietly forwarded to Claude; one came from a user the company believes is tied to the People's Liberation Army, asking for analysis of surveillance footage of a named individual.
What it means
For anyone building on the API, the operational change is preserved thinking. Any integration that rewrites, trims or reinjects earlier reasoning blocks stops working on accounts created from late August onwards, and those blocks are no longer portable across models or across organisations. That hits orchestrators mixing several models, hand-rolled context caches and any pipeline that edits history before resending it.
The second change with a price tag is billing for blocked requests. A bug in the prompt layer that trips the classifier is no longer free, so the count of safeguard-rejected calls belongs on the dashboard next to latency and spend.
There is also a lesson for anyone deploying open-weights models: the warning about GLM-5.3 — guardrails that come off with little effort, Anthropic says — is a reminder that inheriting capability does not mean inheriting safety.
What the announcement leaves out
Every figure is Anthropic's own, measured on its own platform: no external audit, and no public definition of what counts as successful extraction. The 90 to 99 per cent range is presented as early evidence, and the company admits it does not know how long the advantage will hold, expects a cat-and-mouse game, and has not yet faced a genuinely sophisticated, sustained attempt against the new system.
Nor does it say how many legitimate customers have been blocked in absolute terms, or how to appeal a request that was charged and stopped in error. On cost it stays qualitative: meaningful revenue refused and trillions of tokens of paying traffic it chose not to serve. There is no date for extending preserved thinking to older accounts. And the CAISSI assessment and the PLA attribution appear with no supporting material in this note.
Anthropic closes by pointing at the rest of the industry: it says it is publishing its methods to show a workable path exists, and notes that cloud platforms and other inference providers also carry distillation traffic. The trouble, it concedes, is that the incentives run the other way: defences cost money, and distillers pay their bills.