Anthropic cuts the data leaking to Claude distillers by 90–99%

Anthropic claims it has significantly weakened distillation attacks on Claude over the past few months. Preliminary data show that the amount of data distillers manage to collect has dropped by 90–99%. The company calls these attacks covert, industrial-scale campaigns. Their goal is to extract one model's capabilities and reproduce them in another without the developer's permission, usually through networks of fake accounts. According to Anthropic, the defense did not come cheap: the company gave up significant revenue and trillions of tokens of paid traffic.

Why Anthropic sees this as a threat

The company cites two reasons. The first concerns safety. Distillation lets a developer get close to the capability frontier quickly, but the safeguards are reproduced less well. Such models can be misused for harm in biology and cybersecurity.

The main example in the text is Zhipu and GLM-5.3. According to Anthropic, the lab distilled the cyber capabilities of leading American models. It tried to work with Claude Fable 5, but cyber safeguards degraded the quality of its attacks, so Zhipu switched to an older Claude model and a model from another lab. The US center CAISSI later called GLM-5.3 the most cyber-capable open-weights model released to date. Anthropic's own tests showed that GLM-5.3's safeguards are easy to bypass and that the model is willing to write exploits end to end.

The second reason is national security. In Anthropic's account, companies that distill American models build the resulting capabilities into foreign military, intelligence and surveillance systems. The company cites a case involving Moonshot's Kimi: requests to it were secretly forwarded to Claude. One of them, allegedly from a user linked to China's PLA, involved analyzing CCTV surveillance footage of a specific individual.

Why simple measures were not enough

Distillers generate millions of responses from a strong model and train a smaller model on them. The most valuable data for this is not the final answers but the reasoning transcripts, meaning what Claude writes before it answers. They show how the model arrives at a result. As a result, the defense is aimed almost entirely at closing off access to this layer.

The first measure was to summarize the reasoning before showing it to the user. Anthropic tested the effect this way: it fine-tuned a pretrained Claude model on transcripts from Claude Opus 4.8 and measured it on SWE-bench Verified.

• Training on full reasoning: 80.4%.
• Training on summarized reasoning: 71.8%.
• Gap: 8.6 percentage points.
• Reduction in collected data after the new measures: 90–99% (preliminary estimate).

But distillers adapted. They moved from passive collection, where requests are sent like those of an ordinary user, to active extraction, meaning attempts to circumvent restrictions. The available excerpt of the text breaks off at this point, so details of the new defensive methods are not disclosed here. Anthropic promises to describe them in the full version of the blog post.

The cost of protection and what developers should do

Anti-distillation measures hit both Anthropic itself and its customers. The company notes that research and product teams spent a great deal of time on the problem. Some of the changes require legitimate users to update their integrations.

For developers and platforms, the takeaways are practical:

• Check how your application works with summarized reasoning instead of full reasoning. If you built logic on top of it, you will have to change your integration.
• Treat chains of reasoning as a sensitive asset. They are what distillers value most.
• Watch for account anomalies: networks of fake profiles and the rerouting of other people's requests into the API remain the main schemes.
• If you publish open-weights models, evaluate not only quality but also the robustness of safeguards. The GLM-5.3 example shows that bypassing restrictions in such models can turn out to be easy.

Anthropic stresses that every model developer faces distillation. The claimed 90–99% remains the company's own estimate, and the text offers no independent verification. But the choice is clear: Anthropic believes that trillions of tokens of traffic are worth less than the risk of powerful models appearing without proper safeguards.