Anthropic says new defences cut data harvested by Claude distillers by about 90–99%

What's going on? Anthropic says it has made substantial progress against distillation attacks on Claude: covert, industrial-scale campaigns, often run through networks of fraudulent accounts, that extract a frontier model's capabilities to train a cheaper copy. Early evidence suggests its new methods have reduced the amount of data harvested by distillers by around 90 to 99%.

How it works: Distillers prize Claude's written-out reasoning far more than its final answers, so Anthropic's defences focus almost entirely on making that reasoning harder to access. Summarising the reasoning was a first step: in Anthropic's tests, a model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, versus 71.8% when trained on summarised transcripts. Attackers then moved to active extraction, including one lab that tested 12,000 different prompts to trick Claude into revealing its hidden reasoning, which pushed Anthropic to build stronger detection safeguards.

Why it matters: Anthropic frames illicit distillation as both a safety and a national-security issue. It cites Zhipu distilling the cyber capabilities of leading US models while building GLM-5.3, which the US CAISSI has assessed as the most cyber-capable open-weights model released to date, and a case where requests to Moonshot's Kimi models were secretly forwarded to Claude. The company says the defences came at a cost: it turned away meaningful revenue and trillions of tokens of paying traffic, and some legitimate customers had to update their integrations.

Source: Anthropic, "Strengthening our defenses against distillation attacks" (12 Oct 2026)