Anthropic published a research post on 12 October 2026 describing new defenses against distillation attacks on Claude. Distillation attacks are industrial-scale campaigns that pull model outputs, especially hidden reasoning transcripts, to train rival systems without authorization. The company says early evidence shows the methods cut data harvested by distillers by around 90 to 99 percent.
The post frames illicit distillation as both a safety problem and a national security concern. Anthropic argues that distilled models can approach frontier capability without matching safeguards, and it cites cases involving Chinese labs. It says Zhipu distilled cyber capabilities from leading US models while building GLM-5.3, including attempts aimed at Claude Fable 5 before switching after cyber safeguards degraded the attacks. Separately, it recounts Moonshot distillation traffic in which some Claude requests were forwarded from Kimi, including a request Anthropic links to analysis of CCTV surveillance of a specific person.
Earlier defenses focused on summarizing Claude's reasoning before showing it to users. Anthropic reports that a model trained on full Claude Opus 4.8 transcripts scored 80.4 percent on SWE-bench Verified, versus 71.8 percent when trained only on summarized reasoning. Attackers then moved to active extraction, prompting Claude to reproduce prior reasoning verbatim and probing with thousands of jailbreak-style requests.
The new stack has three parts. Preserved thinking on Claude Fable 5.1 and Claude Opus 5.5 stops new API accounts created on or after 31 August 2026 from editing prior context, and later models restrict cross-model and cross-account reuse of reasoning. On Claude Sonnet 5.5, reasoning transcripts are limited to the organization that produced them. A two-stage classifier, similar to Anthropic's constitutional classifiers work, targets extraction attempts on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1, with a stated false positive rate below 0.1 percent. Repeated attempts trigger stricter limits and bans; since 24 September, Anthropic has resumed charging for requests blocked by these low-false-positive safeguards before Claude responds.
After the classifier rolled out, Anthropic says reasoning tokens distillers could extract on its own platform fell by a factor of 10 to 100, sometimes to levels too small to measure, and tens of thousands of related accounts were banned, often within two hours. Reuters coverage the next day restates the same 90 to 99 percent and 10 to 100 times figures, and Anthropic's claim that the safeguards are roughly as robust as its bioweapons refusals.
Anthropic is explicit about costs. It says it turned away meaningful revenue and trillions of tokens of paying traffic from distillers, that preserved thinking forced some developers to update integrations, and that rare false positives can block benign requests. It still expects a cat-and-mouse contest and has not yet seen a highly sophisticated, persistent circumvention of the new stack. The company ends by arguing that other frontier developers and hosting platforms must cooperate, because traffic already spans Anthropic's API, cloud partners, and other inference providers.