Anthropic cuts distillers' extraction of Claude's reasoning by 10–100x

Anthropic says its new anti-distillation measures have cut the volume of data collected by "distillers" by roughly 90–99%. Since the classifier launched, the number of Claude reasoning tokens extracted on the company's own platform has consistently been 10–100x lower than before. On some days it was so low that it could not be measured. Tens of thousands of distillation-linked accounts have been banned, often less than two hours after a campaign started.

Anthropic defines distillation as a covert, industrial-scale campaign: networks of fake accounts collect millions of responses from a strong model and use them to train a smaller one. The answers are not the most valuable part. The chains of reasoning Claude writes before answering are. They let a weaker model learn how the stronger one arrives at a result, so the defense is built almost entirely around access to that reasoning.

Why simple measures were not enough

The first measure was to summarize the reasoning before showing it to the user. Anthropic tested the effect on SWE-bench Verified: a model trained on full Claude Opus 4.8 transcripts scored 80.4%, while one trained on summarized transcripts scored 71.8%. Attackers then moved from passive collection to active extraction. They asked Claude to reproduce its past reasoning verbatim, and one lab tried 12 000 different trap phrasings.

The first versions of the protective filters were bypassed. The attacks were scaled up through proxy networks with hundreds of thousands of fake accounts. These networks resold access in regions where Claude is unavailable and registered with false details and stolen payment credentials. According to a February report, one network ran more than 20 000 accounts at the same time.

Three layers of defense

Attacks are now blocked in three ways:

• Control over the reasoning route. Claude Fable 5.1 and Opus 5.5 now have preserved thinking: new API accounts (created since August 31, 2026) cannot edit past context. This stops attackers from carrying protected reasoning blocks between conversations to convince the model that the user already "knows" them. Reasoning from the new models cannot be read by older models with weaker protection. In Sonnet 5.5, transcripts are available only to the organization whose request produced them.
• A two-stage classifier based on the constitutional classifiers approach. It went through internal and external red-teaming on real distiller attempts. Anthropic estimates it is about as robust as the protection against helping create bioweapons, with a false positive rate below 0.1%. It runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1.
• Making repeat attempts harder. Users who persistently try to extract reasoning get stricter limits, then a ban. Since September 24, the company again charges for requests blocked before a response in areas where false positives are below 0.1%, including distillation.

Quick patches have already closed several new tricks, such as asking Claude to translate its past reasoning into another language or to output it in tags next to the answer.

Why Anthropic is talking about this publicly

The company offers two arguments. The first is that distilled models ship without comparable safeguards. In building GLM-5.3, Zhipu distilled the cyber capabilities of leading American models. It tried to work with Claude Fable 5, but after the defenses degraded its attacks, it switched to an older Claude model and a model from another lab. According to the US CAISSI, GLM-5.3 is now the strongest open-weights model in cybersecurity. Anthropic says its safeguards are easy to bypass and that the model is ready to write exploits end to end.

The second argument concerns national security. Anthropic describes a case in which requests to Moonshot's Kimi were secretly forwarded to Claude. One of them, which Anthropic believes came from a user linked to the PLA, involved analyzing CCTV recordings of a specific person.

The approach has a cost, and the company does not hide it. It gave up significant revenue and trillions of tokens of paid traffic. Some developers have to update their integrations because of preserved thinking. Fewer than 0.1% of legitimate requests may be blocked, and users will now have to pay for those too. Anthropic also says it has not yet seen a truly sophisticated, persistent attempt to bypass the new protection, and it expects the cat-and-mouse game to continue.

What developers and platforms should do

For developers building on Claude, the main practical step is to check whether your code depends on editing past context or reusing reasoning blocks. For accounts created since August 31, 2026, that will no longer work. Build rare false blocks into your error handling, and keep in mind that they are billed.

For cloud platforms and inference providers, the takeaway is harsher. Distillers spread their traffic across Anthropic's API, third-party clouds and other providers, so one lab's defense works only as long as its neighbors leave no loophole. Anthropic says outright that industry incentives push the other way: protection costs money, while a distiller remains a paying customer. Publishing its methods is an invitation to copy the approach: catch requests for hidden reasoning, quickly ban fake accounts, and refuse suspicious payment details.