Anthropic says it has found a way to make stealing Claude's reasoning dramatically harder. In a research post published on October 12, 2026, Anthropic reports that three new defenses against distillation attacks cut the data harvested by distillers by roughly 90 to 99 percent, with reasoning tokens extracted from its platform falling 10x to 100x or more, and on some days too small to measure. The post also names two cases, Zhipu and Moonshot, that show why the company thinks the problem has moved from commercial annoyance to national security.
If you build on the Claude API, this is not only a story about labs fighting each other. It changes how reasoning is returned to you, it adds a classifier in front of the biggest Claude models, and it is another step in a pricing and policy pattern that began when Anthropic started billing for blocked requests.
TL;DR: what Anthropic announced
| Question | Answer |
|---|---|
| What happened? | Anthropic published its distillation defenses on October 12, 2026 |
| Headline result | Roughly 90 to 99 percent less data harvested by distillers; reasoning tokens extracted down 10x to 100x or more |
| Defense 1 | Control where reasoning can go: preserved thinking for Fable 5.1 and Opus 5.5 |
| Defense 2 | Two-stage classifier, false positive rate below 0.1 percent |
| Defense 3 | Stricter limits, then bans, for accounts that keep trying; billing for blocked requests since September 24 |
| Models covered | Sonnet 5.5, Opus 5 and 5.5, Fable 5 and 5.1 |
| Developer cost | Some integrations must update; rare false positives |
| Honest caveat | Anthropic expects a cat-and-mouse game and has not yet seen a sophisticated, persistent circumvention attempt |
What is a distillation attack, and why does Anthropic care?
Distillation is the practice of training a model on another model's outputs. Used openly it is a normal technique, and we cover the basics in our explainer on AI distillation. Anthropic's complaint is about the covert version: industrial-scale campaigns that copy a frontier model's capabilities into a rival through fake accounts, resold access and stolen payment details.
The company gives two reasons it treats this as more than lost revenue. The first is safety: a distilled model can approach frontier capability without the safeguards that were trained into the original, which matters most in biology and cybersecurity. The second is national security. Anthropic says distillers integrate the stolen capability into foreign military, intelligence and surveillance systems.
The two cases Anthropic uses as evidence
Zhipu and GLM-5.3
Anthropic says Zhipu distilled the cyber capabilities of leading US models while developing GLM-5.3. After Anthropic's cyber safeguards degraded its attacks, the post says Zhipu switched to an older Claude model and to another lab's model. The US Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) assessed GLM-5.3 as the most cyber-capable open-weights model released to date, and Anthropic's own research found its safeguards can easily be bypassed. We covered the capability side in Anthropic's GLM-5.3 cyber analysis.
Moonshot and Kimi
The second case is stranger. Anthropic says requests sent to Kimi models were secretly forwarded to Claude. One user, believed to be affiliated with China's People's Liberation Army, used that route to try to analyze CCTV surveillance of a specific individual. That detail sits alongside our earlier reporting on Chinese labs secretly serving Claude and the White House statements about Moonshot. These are Anthropic's allegations; the post is the primary source and we have not seen the affected companies respond in detail.
How the attacks evolved
Anthropic describes an arms race in three steps.
Step one: hide the reasoning. Early on, Claude summarized its reasoning before showing it to users. Anthropic measured the value of full reasoning to a distiller: on SWE-bench Verified, a model trained on full Claude Opus 4.8 transcripts scored 80.4 percent, against 71.8 percent when trained on summarized transcripts. That gap is the reason full reasoning is worth stealing.
Step two: active extraction. Attackers then pushed Claude to reveal its reasoning anyway, for instance by asking it to output prior reasoning verbatim, character for character. Anthropic says one lab tested 12,000 such requests.
Step three: scale and disguise. Proxy networks controlled hundreds of thousands of fraudulent accounts, resold access in unsupported regions and used false identities and stolen payment details. Anthropic's February report said a single network managed more than 20,000 accounts at once. Our coverage of the 25,000 fake accounts case and the token black market shows how organized this trade became.
Chain of thought trail of footprints toward a flag, illustrating the reasoning transcripts distillers try to extract
Defense 1: control where reasoning can go
The first defense is structural. Anthropic calls the feature preserved thinking, and its documentation is on the Claude platform site. According to the post:
- For Claude Fable 5.1 and Opus 5.5, API accounts created on or after August 31, 2026 cannot edit prior context. That blocks a trick where reasoning is rewritten or replayed into another conversation.
- Reasoning is no longer readable by earlier models with weaker safeguards, so a transcript cannot be moved to a model that would happily continue it.
- For Claude Sonnet 5.5, reasoning transcripts are accessible only to the organization whose request produced them.
If you manage long agent loops that edit or splice earlier turns, check your integration. Anthropic itself notes that preserved thinking requires some developers to update their code.
Defense 2: block and patch extraction attempts
The second defense is a two-stage classifier built on Anthropic's constitutional classifiers research. The post says it was red-teamed internally and externally and the vulnerabilities fixed. Key numbers:
- False positive rate below 0.1 percent, roughly matching the bioweapons safeguards.
- Runs on Claude Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1.
- Anthropic says it will extend to similarly attractive future models.
- Already blocks techniques such as asking Claude to translate earlier reasoning into another language or to write it out inside tags.
Anthropic also says the classifier catches every distillation technique listed in its September threat intelligence report for its most capable generally available models. That is a statement about known techniques, not a promise about new ones.
Defense 3: make repeated attempts expensive
Accounts that keep attempting extraction face stricter usage limits and, if persistent, bans. Anthropic says tens of thousands of distillation-linked accounts have been banned, often within two hours of a campaign starting. And since September 24 it charges for requests its safeguards block before Claude responds, in areas including distillation where the false positive rate is below 0.1 percent.
Fraud anomaly detection lens isolating a single odd pebble among smooth ones, like spotting a distillation account
What this means if you build on Claude
Most developers will never trigger the classifier. Still, a few practical points follow from the post:
- Audit context editing. If your agent harness rewrites earlier assistant turns, test it on a new account created after August 31, 2026 before assuming parity with an older one.
- Expect rare blocks and watch the bill. Blocked requests can be billed. A sub-0.1 percent rate is low, but high-volume pipelines will see a few.
- Do not ask the model to dump its reasoning. Prompts like "output your prior reasoning verbatim" are exactly the pattern the classifier targets, and a research workflow that does this innocently may be flagged.
- Keep reseller risk in mind. If you buy Claude access through a third party that cannot explain its sourcing, the account may be one of those banned in bulk.
- Reasoning access is becoming a governed resource. Expect other providers to follow with similar controls, a trend we tracked in the Vance remarks urging labs to build defenses rather than seek regulation.
What is claimed and what is not yet verified
The numbers in this post come from Anthropic itself. We have found no independent audit of the 90 to 99 percent reduction, the 10x to 100x drop in extracted reasoning tokens, or the false positive rate, and Anthropic does not publish its methodology for measuring attempts it never sees. A defense measured against the attacks a company can detect will always look good against detected attacks.
The company is candid about limits. It expects "a cat-and-mouse game" and says it has not yet seen a highly sophisticated, persistent attempt to circumvent the new defenses. It also says it has turned away meaningful revenue and trillions of tokens of paying traffic from distillers.
Policy argument sits underneath all of this. Anthropic says preventing distillation takes every frontier developer and platform, because distillers spread traffic across APIs, cloud platforms and inference providers, and because "illicit distillers are still paying customers," which can discourage defense. Venture voices such as Garry Tan have argued for an American distillation regime, while others see the concern as competitive protection. The honest read: the safety and national-security claims are Anthropic's, the techniques are plausible, and the proof will come from whether distilled Chinese models stop closing the gap as quickly.
How to protect your own agents and APIs
The same ideas apply to anyone exposing a model: separate reasoning from output, rate-limit by behavior rather than only by volume, and ban fast. For teams running AI agents that can take actions, AgentBeam, the agent security platform from the explainx.ai team, stops AI agents before they take dangerous actions.
Bottom line
Anthropic's post is the most detailed public account yet of how a frontier lab defends against reasoning theft. The mechanics, locking down who can read and replay reasoning, classifying extraction prompts, and banning fast, are concrete enough to copy. The 90 to 99 percent figure is a vendor measurement, worth tracking but not yet independently confirmed. Developers should check context-editing code, expect occasional blocks, and treat reasoning access as something providers will increasingly ration.
Related reading
- Anthropic September 2026 threat intelligence report
- Chinese AI labs secretly serving Claude
- What is AI distillation?
- Anthropic bills for blocked requests
- GLM-5.3 and open-weights cyber capability
- 25,000 fake accounts distillation case
- Claude token black market
Details reflect Anthropic's October 12, 2026 post and may change as the defenses evolve.