Anthropic details new anti-distillation defenses: reasoning data harvested by distillation attacks falls by roughly 90 to 99 percent

Start with the central conclusion of the official post. Titled 'Strengthening our defenses against distillation attacks' and published on October 12, 2026, it opens by saying that in recent months the company made substantial progress on reducing the effectiveness of distillation attacks on Claude, and that early evidence suggests these methods cut the amount of data harvested by distillers by around 90 to 99 percent. Anthropic defines distillation attacks as covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another without the authorisation of the original model's developers, often conducted using networks of fraudulent accounts, allowing companies to mimic frontier capabilities for a fraction of the development time and cost. Anthropic says it is concerned for two reasons: first, distilled models can be released without proportionally robust safeguards and used to cause harm in areas such as biology and cybersecurity; second, illicitly distilled models present a national security risk because the companies doing the distilling integrate those capabilities into foreign military, intelligence and surveillance systems. The post states the company has turned away meaningful revenue and trillions of tokens' worth of paying traffic, invested substantial time from its research and product teams, and made changes that required legitimate users to update their integrations.

The technical detail is the most valuable part. Anthropic says the data distillers want most is not the model's output but Claude's reasoning — the thinking process written out before a response, because it helps a smaller model understand how the larger one reaches its answer. Defences therefore focus almost entirely on making that reasoning harder to access. The initial measure was relatively simple: summarising Claude's reasoning before showing it to users. The evaluation figures given are that a pretrained Claude model trained on full transcripts from Claude Opus 4.8 scored 80.4% on the SWE-bench Verified coding benchmark, while one trained only on summarised reasoning scored 71.8% — summarisation genuinely reduces the training value of the data. Attackers then shifted from passive to active extraction, ranging from instructing Claude to output its prior reasoning verbatim to one lab testing 12,000 requests, each trying to trick the model a different way. Anthropic says its defences now disrupt attacks in three separate ways, the first being control over where reasoning can go, because distillers have moved protected reasoning blocks between conversations, between models (using one with weaker safeguards to extract a stronger model's reasoning) and between accounts, so that extraction continues after an initial account is banned. The company says these measures have minimal impact on legitimate users.

The named cases have to be relayed as the official post puts them, with the caveat that these are one-sided characterisations. On Zhipu, Anthropic says the company distilled cyber capabilities of leading U.S. models during the development of GLM-5.3, tried to distil Claude Fable 5, and after finding its cyber safeguards degraded the attacks switched to an older Claude model and another lab's model. Anthropic says the U.S. Center for Advancing Innovation and Standards for Super Intelligence has since assessed GLM-5.3 as the most cyber-capable open-weights model released to date, and that its own research found GLM-5.3's safeguards can be bypassed easily and that the model is willing to develop security exploits end to end. On Moonshot, Anthropic says requests to its Kimi models were secretly forwarded to Claude as part of distillation efforts, and that one request came from a user the company believes was affiliated with China's People's Liberation Army who sought to analyse CCTV surveillance of a specific individual. Anthropic states at the end that for national security reasons it does not currently offer commercial access to Claude in China or to subsidiaries of such companies located outside the country. To be clear, everything above comes from Anthropic's own post; it is the company's allegation and assessment, and the companies named had not responded within that post.

Finally, boundaries and how to read it. First, distillation itself is a widely used and legitimate training method, and frontier labs routinely distil their own models to create smaller, cheaper versions; what Anthropic attacks is unauthorised extraction, and the post makes that distinction explicit. Second, the key number, 90 to 99 percent, is framed by the company as early evidence, not a third-party verified measurement. Third, Anthropic's motives are not only about safety: it also argues that distillation attacks undermine U.S. export controls, since restricted chip access limits both direct model training and the scale of illicit distillation, an argument direction consistent with the company's policy stance. Fourth, the practical impact on users is that anti-distillation measures bring changes to legitimate integrations — the post concedes that some changes required users to update how they connect, and that the company gave up real revenue. Fifth, this post is a follow-up about new defences and is distinct from the earlier February report that detailed three labs, roughly 24,000 fraudulent accounts and more than 16 million exchanges, which remains the more specific accusation document.