Anthropic Cuts AI Distillation Attacks 99% [2026]

Anthropic said on October 12 that a new round of technical safeguards has sharply cut the volume of data rival AI developers can pull out of Claude through so-called distillation attacks, the practice of training a cheaper model on a stronger one’s outputs. The company estimates the methods reduced the data harvested by distillers by roughly 90% to 99%, and cut the number of reasoning tokens extracted by a factor of 10 to 100 compared with earlier levels, according to Anthropic’s own announcement and reporting from Reuters.

The disclosure lands at a moment when anthropic distillation attacks have become one of the most closely watched flashpoints in the AI models industry, as frontier labs pour billions into training runs only to watch competitors allegedly reproduce much of that capability at a fraction of the cost. Anthropic’s update, covering Claude, Claude Fable 5.1, Claude Opus 5.5, and Claude Sonnet 5.5, is among the most detailed public accounts yet of how a major AI lab is trying to close that gap with engineering rather than just legal threats.

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech once in the Google app and our stories appear in your news suggestions.

Add Now

What Anthropic Announced on October 12

According to Anthropic, the company has spent recent months building and deploying a layered set of defenses specifically aimed at distillation, the technique where one party systematically queries a model like Claude and uses the responses, including its step-by-step reasoning, to train a separate, cheaper model that mimics its behavior. Anthropic says the combined effect of these changes has been a reduction of between 90% and 99% in the data harvested by distillers attempting to copy Claude’s capabilities.

A second metric Anthropic highlighted is more specific to the reasoning layer of its models: the number of reasoning tokens that distillers are able to extract is now reported to be 10 to 100 times lower than it was before the new measures went live, a figure also relayed by TechFlow’s coverage of the announcement. Reasoning tokens matter because they contain the intermediate “thinking” steps a model produces before reaching an answer, and that chain-of-thought data is considered especially valuable for training a rival model to replicate sophisticated problem-solving rather than just surface-level answers.

Anthropic frames the effort as an extension of safety work it already does in other domains. The company described the new anti-distillation safeguards as “roughly as robust as those that prevent Claude from helping build bioweapons,” a comparison that signals how seriously it is treating the threat of competitors siphoning off the reasoning capability that differentiates frontier models from cheaper alternatives.

How AI Distillation Attacks Actually Work

Model distillation itself is not inherently malicious. It is a well-established machine learning technique in which a smaller “student” model learns to approximate the behavior of a larger “teacher” model, typically to cut inference costs or run on more modest hardware. The practice becomes a distillation attack when it is done at scale, without authorization, against a commercial API, specifically to reproduce a competitor’s proprietary capability rather than to build an authorized smaller version of one’s own system.

Anthropic’s own explanation, published alongside its research, describes the underlying mechanic directly: “These labs used a technique called distillation, which involves training a less capable model on the outputs of a stronger one,” the company said in its research write-up on detecting and preventing distillation attacks. In practice, that means an attacker spins up large numbers of API accounts, floods Claude with carefully constructed prompts designed to elicit detailed reasoning traces, and logs the responses as training data for a separate model being built elsewhere.

What makes this different from ordinary heavy API usage is both the volume and the pattern. Anthropic says the behavior shows up as coordinated activity across large numbers of accounts, often using automated scripts to extract chain-of-thought reasoning specifically, rather than the kind of varied, business-driven query patterns typical of a normal enterprise customer.

Preserved Thinking: Locking Down Claude’s Reasoning

The centerpiece of the new defenses is a feature Anthropic calls “preserved thinking.” The mechanism prevents new API accounts from editing Claude’s prior reasoning context, a tactic that had previously let sophisticated extractors manipulate a conversation’s history to coax out more raw reasoning data than a typical end-user interaction would ever produce. The restriction applies specifically to API accounts created on or after August 31, 2026, meaning the cutoff is tied to account age rather than applied retroactively across every existing integration.

Anthropic has paired that account-level control with a second structural safeguard: Claude’s reasoning is now blocked from being read by earlier models that carry weaker anti-distillation protections. In effect, Anthropic is treating its own reasoning output as a controlled asset that only the newest, most hardened parts of its model lineup are permitted to process, closing off a path where an older, more permissive model inside Anthropic’s own stack could have been used as an unwitting bridge for extraction.

With Claude Sonnet 5.5 specifically, Anthropic has gone a step further: reasoning transcripts generated by a given request are now accessible only to the organization whose account produced that request. That closes off a scenario where reasoning data generated for one customer could theoretically be visible or reconstructable by a different party operating within the same infrastructure.

Anthropic’s Distillation Safeguards at a Glance

The rollout spans detection, access control, and enforcement. The table below summarizes the individual safeguards Anthropic has confirmed are now active.

Safeguard	What It Does	Status / Date
Preserved thinking	Blocks new API accounts from editing Claude’s prior reasoning context	Applies to accounts created on or after Aug 31, 2026
Two-stage classifier system	Detects distillation-pattern traffic across API requests	False-positive rate below 0.1%
Reasoning access lock (Sonnet 5.5)	Reasoning transcripts visible only to the requesting organization	Live with Claude Sonnet 5.5
Legacy-model reasoning block	Stops older, weaker-safeguard models from reading Claude’s reasoning	Active, ongoing
Usage-limit escalation	Imposes stricter limits on accounts with repeat extraction attempts	Active, ongoing
Account bans	Removes accounts tied to persistent distillation attempts	Tens of thousands banned, per Reuters
Blocked-request billing	Resumed charging for requests blocked by safeguards, including distillation, where false positives stay under 0.1%	Effective Sept 24, 2026

The Two-Stage Classifier System Explained

Detecting a distillation attack in real time is a different problem from simply noticing high API usage. Anthropic says it built a two-stage classifier system specifically to tell the difference between a legitimate power user and an operation designed to harvest training data. The company has described building several classifiers and behavioral fingerprinting systems designed to identify distillation attack patterns in API traffic, including detection of chain-of-thought elicitation used to construct reasoning training data.

The two-stage design matters because it reduces the odds that a single automated signal triggers an unwarranted block on a paying customer. Anthropic has also said it built detection tools for identifying coordinated activity across large numbers of accounts, a capability aimed squarely at operations that spread extraction attempts across many separate logins specifically to avoid tripping single-account usage alarms.

The headline figure Anthropic is using to defend the system’s precision is a false-positive rate below 0.1%. That is the threshold the company says it needed to clear before it felt comfortable taking two further steps: tightening enforcement against repeat offenders, and resuming billing for blocked requests in categories, including distillation, where that low false-positive bar is met.

Tens of Thousands of Accounts Banned

Enforcement is where Anthropic’s announcement moves from engineering description to visible consequence. The company says users who repeatedly attempt to extract Claude’s reasoning now face stricter usage limits, and that accounts associated with persistent distillation attempts are banned outright. According to Reuters, Anthropic has banned tens of thousands of accounts linked to distillation campaigns, a figure that shows how industrial-scale the extraction activity had become before the new safeguards were deployed.

As one industry report on the rollout noted, the response marks the fight against capability theft moving beyond account bans and into structural changes in how reasoning data is stored and shared. Anthropic has not published, and the available reporting does not independently verify, a precise breakdown of how many of those banned accounts were tied to any single operation, nor a dollar estimate of the business lost to extraction before the crackdown. What is confirmed is the scale descriptor itself: tens of thousands of accounts, banned specifically for behavior tied to distillation rather than for other policy violations.

Why Anthropic Invokes Bioweapons-Level Safeguards

The bioweapons comparison is a deliberate rhetorical choice, and it is worth unpacking why Anthropic reached for it. The company’s safety team already maintains a set of hardened restrictions designed to stop Claude from providing information that could help someone build a biological weapon, restrictions that are treated internally as close to non-negotiable given the catastrophic downside of failure. By describing the new anti-distillation protections as “roughly as robust” as that category of safeguard, Anthropic is signaling that it now views large-scale capability theft as a threat on a similar order of institutional priority, not merely a commercial annoyance to be handled by the legal team.

That framing also doubles as a message to the market. Anthropic has invested heavily in training frontier models like Claude Opus 5.5 and Claude Sonnet 5.5, and the company has previously said it continues to invest heavily in defenses that make such distillation attacks harder to execute and easier to identify. Treating the problem with the same engineering seriousness as its highest-tier safety work is a signal to customers, investors, and competitors alike that Anthropic intends to defend the economic value of its frontier research, not just its safety reputation.

The Business Case: Billing Resumes September 24

One of the more commercially significant details in Anthropic’s update is the billing change. On September 24, Anthropic resumed charging for requests that its safeguards block, in categories, including distillation, where the false-positive rate is confirmed to be below 0.1%. Previously, a blocked request, one flagged and stopped before it could extract usable reasoning data, was not billed. That meant an entity running a large-scale extraction operation that got partially blocked was effectively being subsidized by Anthropic’s own infrastructure costs.

By shifting to billing blocked requests once its detection accuracy clears the 0.1% false-positive bar, Anthropic is closing that gap and attaching a direct cost to the act of attempting extraction, regardless of whether the attempt succeeds. It is a quietly aggressive move: rather than relying solely on bans, Anthropic is making repeated distillation attempts expensive even when they fail outright.

Distillation Metrics Before and After the New Safeguards

Anthropic’s own disclosed figures offer a before-and-after snapshot of how much the extraction economics have shifted.

Metric	Before New Safeguards	After New Safeguards (Oct 2026)
Data harvested by distillers	Baseline (100%)	Reduced by approximately 90% to 99%
Reasoning tokens extracted	Baseline	10 to 100 times lower
False-positive rate on legitimate traffic	Not applicable / not disclosed	Below 0.1%
Accounts banned for distillation activity	Not applicable	Tens of thousands, per Reuters
Billing status for blocked requests	Not billed	Billed since Sept 24, 2026, in sub-0.1% false-positive categories

Competition: The Industry-Wide Distillation Race

Anthropic is not alone in grappling with this problem, and the timing of its announcement reflects a broader industry anxiety. Every lab that spends hundreds of millions of dollars training a frontier model, whether that is Anthropic’s own Claude Sonnet 5.5 line competing against GPT and Gemini-class systems, has an incentive to protect the reasoning capability that justifies premium pricing. If a cheaper competitor can approximate 90% of a frontier model’s reasoning quality by distilling its outputs, the economic case for paying a premium for the original erodes fast.

That dynamic has already reshaped pricing across the industry. Anthropic’s own Claude Haiku 5.5 price cut earlier this year helped trigger a broader AI pricing war, as labs raced to make frontier-adjacent capability available at lower cost points before someone else’s distilled model did it for them anyway. The rise of aggressively priced open-weight systems, chronicled in the wave of releases from players chasing the open-source AI bet that accelerated this year, has only sharpened the incentive for frontier labs to lock down the one asset that is hardest to replicate cheaply: high-quality chain-of-thought reasoning.

Anthropic’s response is also part of a wider pattern of AI companies treating API abuse and model security as a core infrastructure problem rather than a side issue. That mirrors how security teams elsewhere in tech have had to adapt enforcement models, a pattern visible in unrelated but structurally similar cases such as the FBI’s pursuit of large-scale data extraction schemes, where detecting coordinated, automated abuse across many accounts required the same kind of behavioral fingerprinting Anthropic says it has now deployed against distillation.

Historical Context: How Distillation Became a Flashpoint

Concerns about model distillation moved from an academic curiosity to a boardroom-level issue once it became clear how much cheaper a distilled model could be to produce compared with training one from scratch. The practice itself long predates the current generation of large language models, but the commercial stakes changed dramatically once frontier labs began charging premium API prices specifically for reasoning quality, the exact attribute that chain-of-thought distillation is best at copying.

Anthropic’s own public documentation on the subject predates this week’s announcement; the company first laid out its detection approach, including classifiers, behavioral fingerprinting, and account-level pattern detection, in earlier research on detecting and preventing distillation attacks. What October 12’s announcement adds is a quantified result: a measured reduction in harvested data of 90% to 99%, and the tens-of-thousands-account enforcement figure that shows the defenses are being applied at scale, not just described in a research paper.

Market Impact and Enterprise Implications

For Anthropic’s enterprise customers, the practical impact of these changes should be minimal day to day, since the restrictions are designed around the 0.1% false-positive threshold specifically to avoid disrupting ordinary usage. The August 31, 2026 account-age cutoff for preserved thinking means businesses with established API accounts predating that date are unlikely to notice any behavioral change at all.

Where the impact is more visible is for developers who rely on patterns that resemble bulk extraction, even unintentionally, such as automated pipelines that repeatedly query a model for long reasoning traces in a narrow domain. Those workflows may now run into stricter usage limits that were not previously enforced as aggressively, since Anthropic’s detection system treats volume and pattern together, not volume alone.

For competitors, the implications are more structural. Any lab whose model development pipeline depended on large-scale extraction from Claude now faces both a shrinking data supply and a higher cost of attempting to acquire it, since blocked requests in the relevant categories are now billed rather than free. That shift raises the effective price of attempting distillation against Anthropic’s models, which is precisely the outcome the company appears to be engineering for.

Expert and Industry Perspective

Anthropic’s own public statements remain the most detailed account available of how the company thinks about this threat. In describing the overall defensive posture, Anthropic said: “We continue to invest heavily in defenses that make such distillation attacks harder to execute and easier to identify,” a line that frames the October 12 update as an incremental step in an ongoing arms race rather than a one-time fix, according to the company’s published research on distillation defenses.

On the detection architecture itself, Anthropic said: “We have built several classifiers and behavioral fingerprinting systems designed to identify distillation attack patterns in API traffic.” The company added a more specific detail about what those systems are tuned to catch, noting that “this includes detection of chain-of-thought elicitation used to construct reasoning training data,” a direct acknowledgment that reasoning traces, not just final answers, are the primary target of modern distillation attempts.

Anthropic also addressed the coordinated, multi-account nature of the attacks it has observed, stating: “We have also built detection tools for identifying coordinated activity across large numbers of accounts.” That detail helps explain why the enforcement response was measured in the tens of thousands of banned accounts rather than a handful of high-profile terminations, since large-scale extraction operations are typically structured to spread activity across many separate logins specifically to stay under the radar of single-account monitoring.

Predictions: Where the Distillation Arms Race Goes Next

Expect other frontier labs to publish their own distillation-defense disclosures within the next two quarters, following Anthropic’s lead in quantifying reductions rather than just describing policy.
Reasoning-token access will likely become a tiered product feature, with premium enterprise tiers getting fuller chain-of-thought visibility while lower tiers see reasoning increasingly abstracted or summarized to limit extraction value.
Account verification requirements for API access are likely to tighten further, extending beyond the August 31, 2026 preserved-thinking cutoff toward broader identity and usage-pattern checks at signup.
Billing blocked requests, the approach Anthropic adopted on September 24, is likely to spread to competitors as a low-friction way to raise the cost of attempted extraction without needing a perfect detection system.
Expect continued friction between frontier labs and the open-weight model ecosystem, as cheaper models trained partly on distilled outputs keep pressuring the pricing of premium reasoning-tier APIs.

What Remains Unverified

Several details that would normally accompany a story of this scale are not independently confirmed in current reporting. There is no independently verified total count of distillation attacks detected, no verified figure for the total volume of tokens extracted before the new safeguards went live, and no confirmed financial impact estimate tied to the lost or stolen capability. The identity of every organization allegedly involved in large-scale distillation against Claude has also not been independently established in the reporting reviewed for this story, and should be treated as unconfirmed until named with sourcing by Anthropic or a named outlet.

What is confirmed, repeatedly, across Anthropic’s own statements and Reuters’ reporting, is the headline range: a 90% to 99% reduction in harvested data, a 10x to 100x drop in extracted reasoning tokens, a sub-0.1% false-positive rate on the detection system, and a ban count in the tens of thousands of accounts.

How This Compares to Anthropic’s Broader AI Security Push

The distillation crackdown fits into a broader pattern at Anthropic of treating infrastructure-level abuse with the same rigor the company applies to model behavior itself. That same instinct for engineering-first enforcement has shown up in how Anthropic’s tooling ecosystem, including developer-facing products like Claude Code integrations developers have been migrating workflows toward, has steadily added account-level and usage-pattern safeguards rather than relying purely on terms-of-service enforcement after the fact.

It also reflects a maturing understanding across the AI sector that benchmark competition, the kind evaluated in head-to-head comparisons such as the benchmark testing used to rank leading chatbot models, is only half the battle. Winning a benchmark is worth less if the underlying reasoning capability that produced the winning score can be cheaply copied within months by a competitor running a distillation operation against the API.

Frequently Asked Questions

What is an AI distillation attack?
It is the unauthorized, large-scale practice of querying a commercial AI model, such as Claude, to collect its outputs and reasoning traces, then using that data to train a separate, cheaper model that mimics the original’s capabilities without authorization.

How much did Anthropic reduce distillation data theft by?
Anthropic says its new methods reduced the amount of data harvested by distillers by approximately 90% to 99%, and cut the number of extracted reasoning tokens by a factor of 10 to 100.

What is “preserved thinking”?
It is a safeguard that prevents new API accounts, specifically those created on or after August 31, 2026, from editing Claude’s prior reasoning context, a tactic previously used to extract more raw reasoning data than normal usage would produce.

Which Claude models are covered by the new safeguards?
Anthropic’s announcement references Claude, Claude Fable 5.1, Claude Opus 5.5, and Claude Sonnet 5.5, with the reasoning-access lock specifically described as active on Claude Sonnet 5.5.

How many accounts has Anthropic banned over distillation attempts?
Reuters reported that Anthropic has banned tens of thousands of accounts linked to distillation campaigns since deploying the new detection and enforcement systems.

Will legitimate developers get caught by the new detection system?
Anthropic says its two-stage classifier system operates with a false-positive rate below 0.1%, which the company used as the threshold for both tightening enforcement and resuming billing on blocked requests.

When did Anthropic start billing for blocked requests?
Anthropic resumed charging for requests blocked by its safeguards, including distillation-related blocks, on September 24, in categories where the false-positive rate stays below 0.1%.

Why does Anthropic compare these safeguards to bioweapons-level restrictions?
Anthropic described the new anti-distillation protections as “roughly as robust as those that prevent Claude from helping build bioweapons,” signaling that the company now treats large-scale capability theft as a top-tier institutional priority rather than a routine commercial dispute.

Anthropic Cuts AI Distillation Attacks by 99% [2026]