Anthropic claims new defenses cut data scraping from Claude by 90–99 percent
In a research post published on October 12, 2026, Anthropic claims that new defense mechanisms have reduced the amount of reasoning data that can be harvested from Claude through so-called distillation attacks by roughly 90 to 99 percent. The same post, for the first time in this series, names the Chinese company Z.ai — known per several outlets also as Zhipu — as an actor that allegedly attempted to distill Claude Fable 5 into its own model GLM-5.3. All headline figures come from Anthropic itself, and no third party has verified them.
Why reasoning transcripts are the prize
The technique Anthropic is defending against is called distillation: training one's own model on the outputs of another. According to the company, the most valuable data are long transcripts of the model's reasoning — not just the final answers. Anthropic has built its argument with an experiment of its own: a model trained on complete Claude reasoning transcripts scored 80.4 percent on the coding benchmark SWE-bench Verified, versus 71.8 percent when trained on summaries. The figures are Anthropic's own, but they illustrate why attackers target the thinking process itself rather than just the answers.
How the defense works — according to Anthropic
The core is a feature the company calls "preserved thinking": new API accounts created on or after August 31, 2026 can no longer edit Claude's prior context. It is precisely through such edits to prior context that attackers, according to the post, got the model to reproduce long reasoning transcripts.
In addition, Anthropic describes a two-stage classifier intended to block extraction attempts with a false positive rate below 0.1 percent. The company states that distillers are now extracting 10 to 100 times fewer reasoning tokens than before, and that tens of thousands of linked accounts have been banned — often within two hours of detection.
All of these figures are the company's own claims, relayed through coverage from Yellow, AI Weekly, and Devdiscourse. AI Weekly points out that no independent party has confirmed the 90–99 percent figure.
The accusations against Z.ai and Moonshot
In the post, Anthropic claims that Z.ai, which several outlets refer to as Zhipu, attempted to distill Claude Fable 5 while the company was building GLM-5.3 — described as "distilling cyber capabilities into GLM-5.3" in Anthropic's post, as relayed by AI Weekly. After the cybersecurity safeguards allegedly degraded the attacks, Z.ai switched, according to Anthropic, to an older Claude model and another lab's model. Z.ai has not responded to requests for comment.
The post also levels serious accusations against Moonshot's Kimi models, which allegedly "secretly forwarded" requests to Claude, including "surveillance analysis requests potentially linked to China's People's Liberation Army." This too is Anthropic's assertion, without documentation from independent sources.
This is not the first time such accusations have been made. A September report from Anthropic claimed that companies such as "DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models, including variants of Claude, GPT, Gemini, and Grok" over two years. These claims have met public skepticism, including via South China Morning Post, quoting Wang Zebin, who has questioned their verifiability.
Geopolitical weight — and an unresolved detail
The naming of Chinese companies in a defense post carries weight beyond the technical: it turns private claims into part of a strained U.S.–Chinese technology relationship, without third parties having confirmed the accusations.
One detail also remains unclear in the coverage. Yellow writes that U.S. assessments at the National Institute of Standards and Technology (NIST) on September 17 ranked GLM-5.3 as the most cyber-capable open-weight model to date, though roughly four months behind U.S. frontier models. Devdiscourse, by contrast, states that the assessment comes from a body called the "US Center for Advancing Innovation and Standards for Super Intelligence." This contradiction cannot be resolved from the available sources and should be interpreted with caution. Devdiscourse also carries the quote that the model is "capable of building end-to-end exploits."
A further caveat: that Z.ai and Zhipu are the same company is treated as a given in the secondary coverage, but the equivalence is asserted — it is not independently documented in the source material.
The cost to legitimate developers
Anthropic admits the defense has costs. The company cites lost revenue and "substantial internal resource investment," along with changes to integrations for some developers and occasional false blocking of legitimate requests. On September 24 the company resumed billing for blocked requests — a change that can genuinely affect developers who are wrongly banned.
For ordinary API customers, the most noticeable change is likely "preserved thinking": new accounts can no longer edit prior context, which breaks some established workflows in agent development and evaluation tooling.
What remains unanswered
Three issues cloud the picture. First, none of the headline figures — the 90–99 percent reduction, the sub-0.1-percent false positive rate, the 10–100x reduction in tokens, or the scale of the bans — has been verified outside Anthropic. Second, the company itself admits it does not know how long the gains will last; distillation attacks have historically adapted to new defenses. Third, the accusations against Z.ai and Moonshot remain unanswered, and they are met with documented skepticism from earlier rounds.
As long as the evidence base is one company's own reporting, the reader should treat the figures as Anthropic's account of its own defense — not as an independent finding.