Anthropic blocks Claude distillation

The short version

Anthropic has moved Claude into a stricter anti-distillation regime. In a research post published on October 12, the company said new defenses reduced the data harvested by distillers by around 90% to 99%, with extracted reasoning tokens now 10 to 100 times lower than before the controls were fully deployed [1]. Reuters reported the same headline figure, framing the move as an attempt to stop rivals from copying the capabilities of Claude models through large-scale querying [2].

The central target is not casual reuse of an answer. It is industrial-scale model distillation: a campaign in which attackers use many accounts, often fraudulent or proxied, to generate huge volumes of responses from a frontier model and then use those outputs to train a competing system [1]. Anthropic says the most valuable material is Claude’s reasoning, because it can expose more of the path from prompt to answer than the final answer alone [1].

That is why the latest measures focus on making protected reasoning harder to extract. Anthropic says its new stack combines “preserved thinking,” a two-stage classifier for extraction attempts, tighter rate limits, account bans and billing for certain blocked requests where false-positive rates are below 0.1% [1]. In practical terms, Claude now has a stricter rate-limit boss battle for users who look like they are trying to harvest its internal reasoning at scale.

Why distillation has become an AI security fight

Distillation is not new in machine learning. A smaller model can be trained to imitate a larger model’s behavior, often making it cheaper to run or easier to deploy. The dispute here is about unauthorized, covert distillation against commercial frontier systems. Anthropic describes these campaigns as attempts to extract the capabilities of one model and replicate them in another without the original developer’s permission [1].

The economics are obvious. If a rival can query Claude at scale and turn those answers into training data, it can potentially narrow a capability gap without paying the full cost of pretraining, reinforcement learning, safety testing and infrastructure. Reuters noted that model distillation has become a major concern for leading AI companies amid intensifying U.S.-China competition, with Anthropic, OpenAI and Google arguing that it can let rivals reproduce advanced capabilities faster and at lower cost [2].

The safety argument is more subtle. Anthropic says illicitly distilled models may approach frontier capability while lacking comparable safeguards, especially in sensitive domains such as cyber and biology [1]. The company also links the issue to national security, saying capabilities obtained through distillation can be integrated into foreign military, intelligence and surveillance systems [1]. The Decoder summarized Anthropic’s position as a warning that extracted capabilities could end up in foreign military and surveillance use [4].

The Z.ai thread

The current story also includes a specific China-linked example. Anthropic cited Zhipu, branded internationally as Z.ai, as a company that allegedly attempted to distill capabilities from Claude while developing GLM-5.3 [1]. Reuters likewise reported that Anthropic cited Z.ai, also known as Zhipu, as an example of a company that tried to distill capabilities from Claude during GLM-5.3 development, and said Z.ai did not immediately respond to a request for comment [2].

Anthropic’s claim is not merely that Z.ai copied a style of answer. The company says Zhipu distilled cyber capabilities from leading U.S. models during GLM-5.3 development and that it tried to distill Claude Fable 5 before switching to an older Claude model and another lab’s model after Claude’s cyber safeguards degraded its attacks [1]. AI Affairs highlighted that Anthropic’s Zhipu allegations are separate from Anthropic’s measurement of reduced extracted reasoning tokens after the new controls went live [3].

That distinction matters. The 90% to 99% reduction is Anthropic’s measurement of how much reasoning distillers are now able to extract on Anthropic’s own platform after the new safeguards. It is not an independent audit of every rival model, every inference provider or every distillation route in the market [1]. It is also not proof that distillation has stopped; Anthropic itself says the problem will remain a cat-and-mouse game [1].

What Anthropic changed inside Claude access

Anthropic describes three layers of defense.

The first layer controls where reasoning can go. With Claude Fable 5.1 and Claude Opus 5.5, Anthropic introduced “preserved thinking,” which prevents new API accounts created on or after August 31, 2026 from editing Claude’s prior context [1]. Anthropic says this blocks tactics in which attackers move protected reasoning between conversations, accounts or models to trick Claude into revealing unsummarized reasoning [1].

The second layer is a two-stage classifier designed to detect attempts to extract Claude’s hidden reasoning. Anthropic says it red-teamed the classifier internally and externally, patched vulnerabilities found during testing, and now runs it on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1 [1]. The company says the classifier has a false-positive rate below 0.1% and is roughly as robust as safeguards used to prevent Claude from assisting with bioweapon-related tasks [1].

The third layer is enforcement. Anthropic says users who repeatedly try to extract reasoning face stricter usage limits, while persistent distillation campaigns can lead to account bans, often less than two hours after a campaign begins [1]. The company also says it has banned tens of thousands of accounts associated with distillation [1]. AI Affairs reported the same enforcement pattern and noted that Anthropic resumed charging for blocked requests in protected categories with sub-0.1% false-positive rates on September 24 [3].

The trade-off: security versus useful access

The hard part is not detecting one suspicious prompt. The hard part is preserving a useful developer platform while blocking organized extraction. Claude’s value comes from being accessible through chat, API integrations and third-party workflows. The same accessibility that makes the product useful also creates a surface for large-scale harvesting.

Anthropic acknowledges the cost. The company says it has turned away meaningful revenue and trillions of tokens of paying traffic from distillers, while requiring some legitimate developers to update integrations because of preserved thinking [1]. It also concedes that benign requests may be misidentified in fewer than 0.1% of cases, and that users can now be charged for certain blocked requests [1]. The Decoder also noted that legitimate users are being caught up in the protections, even as Anthropic urges other AI developers to adopt similar measures [4].

For customers, the message is mixed. On one hand, stronger anti-distillation controls may protect the model quality, safety investments and long-term viability of the Claude platform. On the other hand, any system that restricts context editing, blocks reasoning-extraction patterns or bills blocked requests can create friction for edge-case workflows. Developers who rely on unusual transcript handling, multi-account testing or automated evaluation loops may need to review whether their integrations resemble extraction behavior.

Why this matters beyond Anthropic

Anthropic’s post is also a signal to the rest of the frontier AI market. The company argues that distillers distribute traffic across Anthropic’s API, third-party cloud platforms and other inference providers, meaning one lab’s defenses can be undermined if attackers simply move to less protected access points [1]. In other words, anti-distillation is becoming a platform-wide security problem, not just a single-model feature.

That puts cloud providers, API resellers and inference platforms in the middle of the fight. If they can quickly detect abuse and offboard fraudulent accounts, they can materially slow distillation campaigns [1]. If they do not, they may become the soft route around a frontier lab’s own controls.

The policy stakes are rising too. Reuters framed the story against intensifying U.S.-China competition, and Anthropic’s own post repeatedly connects distillation to cyber capability, national security and surveillance concerns [1][2]. Whether policymakers treat distillation as IP theft, cyber abuse, export-control leakage or ordinary competitive learning will shape how aggressively labs can limit access.

The bottom line

Anthropic’s new Claude defenses do not end distillation. They raise its cost. By reducing extracted reasoning tokens by 10 to 100 times, banning tens of thousands of accounts and making repeated probing more expensive, Anthropic is trying to make industrial-scale imitation less attractive [1].

The broader lesson is that frontier model access is becoming a security product as much as a developer product. The winners will not only be the labs with the best models, but the labs that can let real users build while making mass capability extraction painful, expensive and unreliable. For Claude, that now means a much tougher gate around reasoning, rate limits and suspicious traffic.

Sources from the last 72 hours

1. [1]Strengthening our defenses against distillation attacksOct 12, 2026, 2:00 AM
2. [2]Anthropic says new safeguards sharply reduce AI distillation attacksOct 12, 2026, 11:11 PM
3. [3]Anthropic says defences cut extracted Claude reasoning by 90 to 99%Oct 13, 2026, 3:45 PM
4. [4]Anthropic says it cut Claude reasoning token theft by up to 99% in fight against industrial-scale distillationOct 13, 2026, 2:00 AM

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.