Anthropic says new defenses cut data harvested from Claude by 90 to 99 percent

Anthropic reports that recently strengthened defenses have reduced the amount of data harvested from Claude through distillation attacks by around 90 to 99 percent, according to early evidence the company shared. The findings, published in a post on Anthropic's research site that reached the Hacker News front page, describe an escalating contest between the lab and operators running covert, industrial-scale extraction campaigns.

What distillation attacks go after

According to Anthropic, a distillation attack uses large volumes of queries, often routed through networks of fraudulent accounts, to pull a model's capabilities into a cheaper replica built by someone else. The most valuable data is not Claude's final answer but its reasoning transcripts, the working-out the model produces beforehand, because that material teaches a smaller model to imitate how a larger one thinks rather than merely what it concludes.

Simple countermeasures, and how attackers moved past them

Anthropic's first measure was to have Claude summarize its reasoning before showing it to users. In the company's own evaluation, a pretrained Claude model trained on full transcripts from Claude Opus 4.8 scored 80.4 percent on SWE-bench Verified, while the same setup trained only on summarized transcripts scored 71.8 percent, a measurable drop in how useful the harvested data is.

Distillers responded by shifting from passive collection to active extraction, prompting Claude to reproduce its hidden reasoning verbatim. Anthropic's September report catalogued tactics ranging from blunt instructions to one laboratory that tested roughly 12,000 distinct requests, each designed to trick the model differently. When detection rules began catching these attempts, attackers scaled up proxy networks controlling hundreds of thousands of fraudulent accounts, complete with false identities and stolen payment details, and resold access in regions where Claude is not offered. One network described in Anthropic's February report ran more than 20,000 accounts at once.

The new three-part defense

Anthropic says its current defenses disrupt attacks in three separate ways, and the published post details the first two in full.

The first prong controls where reasoning can travel. A feature called preserved thinking, introduced with Claude Fable 5.1 and Claude Opus 5.5, prevents new API accounts, meaning those created on or after August 31, 2026, from editing Claude's prior context, closing a route that proxy networks used for repeated extraction attempts. Anthropic also blocked these models' reasoning from being read by earlier models that carry weaker anti-distillation safeguards, and with Claude Sonnet 5.5 it made reasoning transcripts accessible only to the organization whose request produced them.

The second prong treats distillation like any other dangerous use case: Anthropic says it has applied the same kinds of safeguards it deploys against harmful cybersecurity and biology requests in order to block and patch extraction attempts.

The cases Anthropic names

The post grounds the threat in two concrete examples. Anthropic says Zhipu distilled the cyber capabilities of leading US models while developing GLM-5.3, and tried to distill Claude Fable 5 before switching to an older Claude model and another lab's model after finding that Anthropic's cyber safeguards degraded the resulting attacks. The US Center for Advancing Innovation and Standards for Super Intelligence has assessed GLM-5.3 as the most cyber-capable open-weights model released to date, and Anthropic's own research found its safeguards easy to bypass, with the model willing to develop security exploits end to end.

Anthropic also reports that requests to Moonshot's Kimi models were secretly forwarded to Claude as part of distillation efforts, including one from a user the company believes was affiliated with China's People's Liberation Army, who sought to analyze CCTV surveillance of a specific individual.

The cost side of the ledger

The measures come with trade-offs that Anthropic acknowledges. The company says it has turned away meaningful revenue and trillions of tokens' worth of paying traffic identified as distillation, invested substantial research and product effort, and required some legitimate users to update their integrations.

Why it matters

Two things elevate this beyond a single vendor's security update. First, reasoning traces are becoming the most closely guarded asset in frontier AI, and if summarization plus access controls can cut harvested data by 90 to 99 percent, every model provider now has a template for protecting that asset. Second, Anthropic's examples make the argument that distilled models inherit capability without proportional safeguards, and that the extracted capabilities are being folded into foreign military, intelligence and surveillance systems. The open question for the wider ecosystem is whether hard API restrictions, such as locked-down context editing and organization-scoped reasoning, become standard practice, and how much friction legitimate developers will absorb as the price of that protection.