Anthropic Says It Cut Theft of Claude Reasoning Tokens by 90–99%

Anthropic says it has cut the extraction of Claude's internal reasoning tokens by 90–99%. The company links large-scale distillation attacks to the Chinese firms Zhipu and Moonshot and reports blocking tens of thousands of accounts. The figures so far rest only on Anthropic's word: the material available to us contains neither a baseline nor a description of how the numbers were calculated.

What Attackers Were Trying to Extract

Distillation is a long-standing technique and, in principle, a legitimate one: a smaller or simply different model is trained on the outputs of a stronger one. Problems start when the "teacher" is someone else's closed model and the terms of service prohibit such use. For a commercial leader, it effectively shifts its training investment onto a competitor's balance sheet.

With reasoning models, the value is especially high. The final answer shows the result; the chain of reasoning shows the path to it: which steps the model takes, where it double-checks itself, how it breaks a task down. Such traces are ready-made training material for reproducing similar behavior in another system. That is why Anthropic talks specifically about reasoning tokens, and not about ordinary API outputs.

What We Know About the Countermeasures

The statement boils down to the following:

• extraction of Claude's internal reasoning is down by 90–99%;
• tens of thousands of accounts have been blocked;
• two Chinese companies, Zhipu and Moonshot, are named as involved;
• the attacks are described as "industrial", meaning systematic and distributed rather than one-off experiments by individual users.

A scale of tens of thousands of accounts points to a typical scheme: requests are split across many accounts so that each one looks like an ordinary user. Defending against this relies on behavioral analysis, not on rate limits for a single key. Anthropic does not disclose its specific mechanisms in the text available to us.

What the Statement Leaves Out

Several questions remain open at once. A range of "90 to 99%" is a nearly tenfold difference in residual leakage: at 99%, one-hundredth of the traffic gets through; at 90%, one-tenth. It is unclear what the metric is applied to: the number of requests, the volume of tokens, or an estimate of the usefulness of the extracted data. It is also unclear what evidence supports attributing the attacks to specific companies — infrastructure, payment trails, or the content of the requests. The positions of Zhipu and Moonshot are absent from the available materials.

The metric itself also warrants a cautious reading. If the defenses reduced leakage but the attackers moved to other channels — for example, intermediaries and access resellers — the real effect will be smaller than claimed. Such checks are usually done by outside researchers, and none exist yet.

Practical Takeaways

For teams building products on closed models, the main signal is tighter control over accounts. Those who work through aggregators and proxies should check where the intermediary gets its access and whether it violates the provider's terms: chain blocks also hit honest customers. Companies that fine-tune their own models would do well to track data provenance and explicitly exclude third-party model outputs where the license forbids them. And developers of open models in China, judging by the statement, will have to answer not only for quality but also for the cleanliness of their training data.

The distillation dispute itself will only sharpen: the more expensive it becomes to train frontier systems, the stronger the temptation to get the result on the cheap — and the harder labs will work to hide and protect their reasoning.