Anthropic said on October 12, 2026 that new defenses have sharply cut how much of Claude’s reasoning distillers can extract. In its words: “Early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99 percent.” The post describes three defenses, names Zhipu and Moonshot, and is unusually direct about what the defenses cost legitimate users.
On this page · 7 sectionsOpen
Anthropic said on October 12, 2026 that its new defenses cut the reasoning data distillers harvest from Claude by around 90 to 99 percent, 10 to 100 times less than before.
Distillation attacks pull a strong model’s outputs at scale to train a cheaper copy, often through networks of fraudulent accounts; one network ran more than 20,000 accounts at once.
Three defenses: preserved thinking (API accounts created on or after August 31 cannot edit Claude’s prior context), a two-stage classifier, and stricter limits and bans.
Reasoning is the prize: a model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, against 71.8% when trained on summaries.
Anthropic names Zhipu, saying it distilled US models’ cyber skills while building GLM-5.3 and tried Claude Fable 5 first.
The costs land on users too: some integrations had to change, and since September 24 Anthropic charges for requests its classifiers block, which it puts under 0.1%.
§ 01What distillation is, and why reasoning is the target
Distillation attacks send a stronger model millions of requests and train a smaller model on the answers. Anthropic calls them “covert, industrial-scale campaigns” usually run through networks of fraudulent accounts; one network it described in February managed more than 20,000 accounts at once. The prize is Claude’s reasoning, the thinking it writes before answering.
Anthropic’s own test shows why. It trained a pretrained Claude model on transcripts from Claude Opus 4.8 and measured SWE-bench Verified:
That is why Anthropic first summarized Claude’s visible reasoning, and why distillers moved to tricking Claude into revealing it in full.
§ 02The three defenses
| Defense | What it does | Applies to |
|---|---|---|
| Preserved thinking | API accounts created on or after August 31, 2026 cannot edit Claude’s prior context; reasoning cannot be read by older models with weaker safeguards | Claude Fable 5.1, Claude Opus 5.5; Sonnet 5.5 reasoning visible only to the requesting organization |
| Two-stage classifier | Detects attempts to extract hidden reasoning; Anthropic says it is “roughly as robust as those that prevent Claude from helping build bioweapons” | Sonnet 5.5, Opus 5 and 5.5, Fable 5 and 5.1 |
| Limits, bans and charges | Stricter usage limits on repeat attempts, account bans, and since September 24 charging for blocked requests | Accounts caught distilling; blocked requests in areas under 0.1% false positives |
Anthropic says the classifier now catches every technique from its September report and that fixes have closed newer tricks, such as asking Claude to translate earlier reasoning into another language. It has banned tens of thousands of accounts, often within two hours of a campaign starting. After the classifier, reasoning tokens extracted on its platform were “consistently 10 to 100 times lower than it was before.”
§ 03Who it names
Anthropic says Zhipu “distilled the cyber capabilities of leading US models during the development of GLM-5.3,” tried Claude Fable 5, then switched to an older Claude model and another lab’s model once Anthropic’s cyber safeguards degraded its attacks. It also repeats an earlier finding that requests to Moonshot’s Kimi models were secretly forwarded to Claude. Our records on Anthropic’s GLM-5.3 cyber report and OpenAI’s Moonshot distillation case cover both; neither company’s response appears in the post.
§ 04What it costs, in Anthropic’s own words
The post does not claim the defenses are free. Preserved thinking “has required some developers to update their integrations,” the classifiers can block benign requests in fewer than 0.1% of cases, and users now pay for those blocked requests. Anthropic also says it has turned away meaningful revenue and “trillions of tokens’ worth of paying traffic from distillers.”
And it hedges the result: “We don’t yet know how long these gains will last.” It adds that “we have yet to see a highly sophisticated and persistent attempt to circumvent them.” The 90 to 99 percent figure is Anthropic’s own estimate, measured on its own platform; the post notes distillers also route traffic through third-party clouds and inference providers.
§ 05What this means if you build on Claude
Our conflict, declared: every CellCog tier runs Claude Opus 5.5, so these safeguards run on our traffic. We have not measured any effect on our product.
For builders, two details matter. If your API account was created on or after August 31, 2026, preserved thinking means you cannot rewrite Claude’s earlier reasoning blocks between turns; harnesses that edit context need to keep reasoning intact. And blocked requests now cost money, so an integration that trips the classifier repeatedly pays for it. The same day, Anthropic’s red team published a separate post on small models self-replicating on cheap devices, and its September threat intelligence report set out the extraction techniques this post says it now catches.
§ 06What we are watching
- A sophisticated bypass. Anthropic expects one; the first public report of a new extraction technique.
- Other labs and platforms. Whether OpenAI, Google or cloud providers adopt comparable classifiers or account rules.
- Zhipu’s response to being named.
§ 07Sources
- Anthropic, Strengthening our defenses against distillation attacks, October 12, 2026, read 01:14 UTC October 13.
- Anthropic, Detecting and countering misuse of AI: September 2026.
- Anthropic, Threat intelligence index.
- Anthropic Frontier Red Team, AI models may be capable of self-replicating without access to a datacenter, October 12, 2026.
Q1Which models carry the classifier?
Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1, per Anthropic, plus future models attractive to distillers.
Q2How often does it block normal requests?
Anthropic puts the false positive rate under 0.1%, and since September 24 it charges for requests blocked before Claude responds in areas with that rate.
Q3Do I need to change my integration?
Possibly. Anthropic says preserved thinking required some developers to update integrations; it applies to API accounts created on or after August 31, 2026.
Q4Is the fight over?
No. Anthropic says it does not yet know how long the gains will last and has not yet seen a highly sophisticated, persistent attempt to get around them.
Q5Has anyone checked the 90 to 99 percent figure?
No. It is Anthropic’s own estimate of reasoning tokens extracted on its own platform; traffic through other clouds and providers is outside it.
Q6Does CellCog use Claude?
Yes. Every CellCog tier runs Claude Opus 5.5, so these safeguards run on our traffic; we have not measured any effect on our product.