Anthropic claims new defenses cut data harvesting from Claude by 90–99 percent
Anthropic claims that new countermeasures against so-called distillation attacks have reduced the amount of data competitors harvest from the Claude models by roughly 90–99 percent.
What's new
On October 12, 2026, Anthropic published a research blog post and tweeted about new defenses against distillation attacks — methods by which competing labs use a model's outputs, particularly its reasoning traces, to train their own models. Reuters and other media followed up with coverage on October 13. Anthropic writes that the company "in recent months" has made "significant progress in reducing the effectiveness of distillation attacks against Claude with new methods", and that "early evidence suggests these methods have reduced the amount of data harvested by distillers by roughly 90 to 99 percent."
All key figures in this story come from Anthropic itself. No independent source has confirmed them, and the company itself describes the results as early indications.
How the defenses work
The package of measures consists, according to Anthropic and secondary coverage, of four parts:
Preserved thinking. For Claude Fable 5.1 and Claude Opus 5.5, this prevents new API accounts — created on or after August 31, 2026 — from editing Claude's prior context (Times of AI).
Restricted access to reasoning transcripts. With Claude Sonnet 5.5, transcripts of the model's reasoning are sent only to the organization that triggered the request — not to third parties building on the API.
Blocking between model generations. Anthropic has also closed off the ability of weaker, older models to read protected reasoning from newer models (International Business Times).
Two-stage classifier. A two-stage classifier catches distillation behavior in traffic. Anthropic reports a false-positive rate below 0.1 percent, and claims the safeguards are roughly as robust as the company's own safeguards against bioweapons.
The evidence Anthropic points to
The most concrete piece of documentation is a dedicated experiment on SWE-bench Verified, a coding benchmark. Anthropic trained a pre-trained Claude model on transcripts from Claude Opus 4.8. With complete transcripts, the distilled model achieved 80.4 percent; with only summarized transcripts, the result dropped to 71.8 percent (Anthropic's blog). The point is to show that summarizing the reasoning degrades the value of distillation.
In addition, Anthropic reports that reasoning tokens extracted by distillers have fallen to regularly 10–100 times lower levels than before, and that tens of thousands of linked accounts have been banned — often within two hours of a campaign starting (IBTimes).
There is no independent confirmation of any of this. The SWE-bench test and the traffic measurements are Anthropic's own, carried out on Anthropic's own data.
The price — according to Anthropic itself
Anthropic acknowledges that the defense is not free. The company writes that it has "forgone meaningful revenue and paying traffic worth trillions of tokens" from distillers, and that some changes "have required legitimate users to update their integrations." As of September 24, Anthropic also charges for some blocked requests (Times of AI).
The company itself says, according to Times of AI, that it is unclear whether the defenses will succeed in the long term. That is a remarkable admission: distillation is a cat-and-mouse dynamic, and every countermeasure can in principle be circumvented by a distiller that finds new access routes.
The allegations against Zhipu — and what is verified
The blog post also contains allegations. Anthropic claims that Zhipu "distilled the cyber capabilities of leading American models" during the development of GLM-5.3, and that the company attempted to distill Claude Fable 5, but that "after discovering that our cyber safeguards degraded the attacks, it switched to an older Claude model and another lab's model." Anthropic further writes that the US Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) has assessed GLM-5.3 as the most cyber-capable open-weights model to date (Anthropic's blog).
Two caveats are essential. First, this is Anthropic's account; Z.ai did not respond to Reuters' request for comment (Reuters via The Hindu BusinessLine). Second, the CAISSI assessment is known only through Anthropic's characterization.
What remains to be answered
The big unanswered question is how durable API-level defenses are over time. Anthropic's own figures suggest the measures work against today's techniques, but the company acknowledges that long-term success is uncertain. Another open aspect is that the entire evidence picture comes from a single interested party: the lab that sells API access and has an incentive to portray both its own defenses as effective and its competitors' methods as aggressive. Independent measurement of how much reasoning data actually flows out of commercial APIs does not exist — and that is precisely the measurement that would make the 90–99 percent figure more than a company claim.