Anthropic's New Defenses Reduce Data Harvesting on Claude by Up to 99%

A defensive turn in the AI model race

Anthropic has put a number on a problem that frontier AI companies increasingly describe as one of their hardest security challenges: covert attempts to harvest model outputs and hidden reasoning at industrial scale. In a research post dated October 12, 2026, the company said new defenses against distillation attacks on Claude have reduced the amount of data harvested by distillers by around 90% to 99% [1]. Reuters separately reported the same headline figure, describing the measures as safeguards meant to prevent rivals from copying Claude’s capabilities through so-called model distillation [2].

The working headline is therefore the story itself: Anthropic is claiming that new Claude defenses reduce data harvesting by up to 99%. The important nuance is what kind of data is at issue. This is not primarily a claim about ordinary user files being stolen from Claude accounts. Anthropic is describing attempts to extract Claude’s reasoning traces and other high-value outputs so they can be used to train competing models [1]. That still has a privacy dimension: if reasoning transcripts, conversation context, or API behavior can be pulled across accounts, organizations, or resellers, then the boundary between a customer’s interaction and a distiller’s training pipeline becomes a security concern.

Anthropic defines illicit distillation as covert, industrial-scale campaigns that extract the capabilities of one model and reproduce them in another without authorization, often through fraudulent accounts [1]. The company argues that this can let rivals approach frontier capability at a fraction of the time and cost required to build a model from scratch [1]. Reuters framed the issue in the wider context of U.S.-China AI competition, noting that Anthropic, OpenAI, and Google have all argued that distillation can help rivals reproduce advanced capabilities more quickly and cheaply [2].

Why Claude’s reasoning became the target

The most valuable prize for a distiller is not necessarily Claude’s final answer. It is the reasoning that leads to that answer. Anthropic says summarized reasoning is far less useful for training a copycat model than full reasoning transcripts: in one internal comparison, a model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, while a model trained on summarized reasoning scored 71.8% [1]. Explainx.ai’s October 13 analysis highlighted the same test as the reason attackers would spend effort trying to recover hidden reasoning rather than simply collect final responses [4].

That explains the arms race. Anthropic first limited what users could see by summarizing reasoning. Attackers then shifted to active extraction, trying to trick Claude into revealing its prior hidden reasoning directly [1]. The company says some prompts were simple, such as asking Claude to output prior reasoning verbatim, while others were more complex; Anthropic cited one lab that tested 12,000 requests, each designed to trick Claude in a different way [1]. Dealroom’s current note on the announcement likewise emphasized that distillers prize Claude’s written-out reasoning and that Anthropic’s defenses now focus heavily on making that reasoning harder to access [5].

The tactics also scaled beyond isolated prompt experiments. Anthropic says attackers used proxy networks controlling hundreds of thousands of fraudulent accounts, resold access to Claude in regions where it is not offered, and used false identities and stolen payment details [1]. Reuters reported that Anthropic has banned tens of thousands of accounts linked to distillation campaigns [2]. Newsquawk’s October 13 headline added that Anthropic said it had turned away “meaningful revenue” and trillions of tokens’ worth of paying traffic from distillers [3].

The three-part defense

Anthropic’s new posture has three parts: control where reasoning can go, block extraction attempts, and make repeated attempts costly [1].

The first part is structural. With Claude Fable 5.1 and Claude Opus 5.5, Anthropic introduced “preserved thinking,” which prevents new API accounts created on or after August 31, 2026 from editing Claude’s prior context [1]. The point is to stop attackers from moving protected reasoning between conversations or accounts in ways that make Claude behave as if the hidden reasoning has already been shared [1]. Anthropic also says it has prevented reasoning from these newer models from being read by earlier models with weaker anti-distillation safeguards, and with Claude Sonnet 5.5 it has made reasoning transcripts accessible only to the organization whose request produced them [1].

The second part is a blocking system. Anthropic says it built a two-stage classifier using transcripts of distillers’ extraction attempts, then subjected it to internal and external red-teaming [1]. The company says the resulting safeguards are roughly as robust as the measures it uses to prevent Claude from helping build biological weapons and have a false-positive rate below 0.1% [1]. Reuters reported that the classifier is meant to restrict access to Claude’s reasoning and that extracted reasoning tokens are now 10 to 100 times lower than before [2].

The third part is economic and operational pressure. Anthropic says accounts that repeatedly try to extract reasoning face tighter usage limits and bans [1]. Since September 24, the company has also resumed charging for requests blocked before Claude responds in specific areas, including distillation, where it says the false-positive rate is below 0.1% [1]. Explainx.ai noted the practical effect for developers: blocked requests can still be billed, and some legitimate integrations that edit or splice prior context may need to be updated [4].

The headline number: 90% to 99% less harvesting

The central claim is that, after these measures, the amount of reasoning data distillers can harvest from Claude on Anthropic’s own platform has fallen dramatically. Anthropic says extracted reasoning tokens are consistently 10 to 100 times lower than before, and on some days too small to measure [1]. Newsquawk summarized the announcement as “substantial progress” that reduced the amount of data harvested by distillers by around 90% to 99% [3].

That is a major security claim, but it is still a company-measured claim. Anthropic has not published a full external audit of the reduction, and Explainx.ai explicitly cautioned that the figures come from Anthropic itself and are not independently verified [4]. The distinction matters because a platform can measure what it detects on its own infrastructure more easily than what moves through third-party cloud platforms, resellers, or competing APIs. Anthropic itself says distillers distribute traffic across its API, third-party cloud platforms, and other inference providers, which means no single vendor can see the entire battlefield [1].

Still, the company’s willingness to name mechanisms is significant. Instead of simply saying “we blocked abuse,” Anthropic is describing an anti-distillation architecture: restrict the mobility of reasoning, identify prompts that seek hidden traces, patch around newly observed extraction methods, limit repeat offenders, ban campaigns, and make blocked abuse more expensive [1]. That makes the announcement relevant not only to Claude users, but also to every company exposing high-value model behavior through an API.

Privacy, security, and the meaning of “data theft”

For ordinary users, the word “harvesting” may sound like theft of personal data. Anthropic’s announcement is more specific: the target is Claude’s protected reasoning and the capability signal contained in model outputs [1]. But the privacy implications are still real. If attackers can move reasoning across accounts, replay context, or use proxy networks and resold access, then the boundaries that keep one organization’s interaction separate from another party’s training operation become critical.

The privacy improvement is therefore indirect but important. By making reasoning transcripts organization-bound in Claude Sonnet 5.5 and limiting how prior context can be edited or reused in newer accounts, Anthropic is reducing the surface through which hidden reasoning data can leak or be repurposed [1]. These are not consumer privacy features in the familiar sense of deleting chat histories or changing retention periods. They are platform integrity controls that prevent one user’s or organization’s interaction with Claude from becoming raw material in someone else’s unauthorized model-training workflow.

There is also a developer trade-off. Some agent systems depend on editing conversation history, replaying context, or passing traces between components. Those designs may collide with preserved thinking or reasoning-access controls [4]. Anthropic says the impact on legitimate users is minimal, but it also acknowledges that some customers had to update integrations [1]. In other words, stronger privacy and anti-harvesting controls can impose new rules on how developers build long-running Claude workflows.

A cat-and-mouse fight, not a final victory

Anthropic is careful not to declare the problem solved. The company says distillation will remain a cat-and-mouse game and that it has not yet seen a highly sophisticated and persistent attempt to circumvent the newest defenses [1]. That caveat is essential. A 90% to 99% reduction is meaningful if it holds, but attackers have incentives to adapt, especially if full reasoning transcripts materially improve the training of rival models.

The announcement also raises a broader industry question: will other labs and platforms adopt comparable defenses? Anthropic argues that preventing illicit distillation requires buy-in from all frontier model developers, because attackers can shift traffic to models or providers with weaker protections [1]. Reuters reported the company’s warning that these practices pose safety and national-security risks, citing Anthropic’s allegation that Zhipu attempted to distill capabilities from Claude while developing GLM-5.3 [2]. Newsquawk interpreted the public naming of a Chinese lab as a sign that quiet enforcement may be giving way to customer, partner, and regulator-facing pressure [3].

For Claude customers, the immediate takeaway is practical: do not build workflows that ask for hidden reasoning, audit systems that rewrite prior context, monitor for unexpected blocked-request billing, and treat third-party Claude access with caution. For the AI industry, the larger message is that reasoning access is becoming a governed resource. The more valuable model traces become as training data, the more frontier labs will lock them down.

Anthropic’s claim is not the end of model distillation. It is an escalation in the defensive playbook. If the company’s measurements hold, the new Claude safeguards have made unauthorized harvesting much harder. But the durability of that 90% to 99% reduction will depend on whether the defenses work against the next wave of extraction tactics, not only the last one.

Developments

1. Anthropic reduces Claude reasoning token theft by 99% in industry crackdownThe Decoder · Oct 13, 2026, 1:07 PM · 9/10
2. Anthropic cuts Claude reasoning token theft by 90-99% amid industry security measuresThe Decoder · Oct 13, 2026, 1:06 PM · 9/10
3. Anthropic's defenses cut Claude data harvesting by 90-99%Dealroom · Oct 13, 2026, 12:09 PM · 8/10
4. Data Theft Attacks on Claude Cut by 99% with New Measures, Linked to Chinese CampaignsInshorts · Oct 13, 2026, 11:21 AM · 9/10
5. Anthropic's new safeguards sharply reduce AI distillation attacksThe Straits Times · Oct 13, 2026, 9:25 AM · 8/10
6. Anthropic boosts defenses against AI distillation, cuts data theft by 99%BigGo Finance · Oct 13, 2026, 8:25 AM · 8/10
7. Anthropic strengthens defenses against Claude distillation attacks, cuts data harvestingThe Economic Times · Oct 13, 2026, 7:24 AM · 8/10
8. Anthropic boosts defenses against distillation attacks, cuts data harvesting by 90%The Economic Times · Oct 13, 2026, 7:24 AM · 7/10
9. Anthropic cuts Claude AI model distillation attempts by up to 90% with new safeguards - FirstpostFirstpost · Oct 13, 2026, 6:22 AM · 8/10
10. Anthropic reduces Claude AI distillation attempts by 90% with safeguardsFirstpost · Oct 13, 2026, 6:22 AM · 8/10
11. New safeguards sharply reduce AI distillation attacks, says AnthropicBusiness Standard · Oct 13, 2026, 4:49 AM · 8/10
12. Anthropic Claims New Safeguards Significantly Reduce AI Distillation AttacksThe Edge Malaysia · Oct 13, 2026, 3:32 AM · 8/10
13. Anthropic's New Safeguards Significantly Reduce AI Distillation AttacksWTVB · Oct 13, 2026, 3:22 AM · 9/10
14. Anthropic announces new safeguards to reduce AI distillation attacksSan Luis Obispo Tribune · Oct 13, 2026, 3:14 AM · 8/10
15. Anthropic introduces safeguards sharply reducing AI distillation attacksSan Luis Obispo Tribune · Oct 13, 2026, 3:14 AM · 8/10
16. Anthropic Implements New Safeguards to Reduce AI Distillation AttacksAOL.com · Oct 13, 2026, 3:11 AM · 8/10
17. Anthropic's New Safeguards Significantly Reduce AI Distillation AttacksAOL.com · Oct 13, 2026, 3:11 AM · 8/10

Sources from the last 72 hours

1. [1]Strengthening our defenses against distillation attacksOct 12, 2026, 2:00 AM
2. [2]Anthropic says new safeguards sharply reduce AI distillation attacksOct 12, 2026, 11:11 PM
3. [3]Anthropic says it made "substantial progress" on reducing effectiveness of distillation attacks on Claude using new methodsOct 13, 2026, 2:19 AM
4. [4]Anthropic says new defences cut data harvested by Claude distillers by about 90–99%Oct 13, 2026, 12:06 PM
5. [5]Anthropic Says New Distillation Defenses Cut Stolen Reasoning Data by 90 to 99 PercentOct 13, 2026, 2:00 AM

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.