Anthropic says new safeguards cut Claude data harvesting by 90–99%
The company claims new security measures have cut data collection against Claude by 90–99%, naming China's Z.ai as an example. Every effectiveness figure remains the company's own, not independently verified.
Anthropic announced on October 12, 2026 a package of new security measures that, the company says, have reduced the amount of data harvested in so-called distillation attacks against its Claude models by roughly 90 to 99 percent. The number of reasoning tokens attackers manage to extract is now "10 to 100 times lower than it was before," according to the company. Alongside the figures, Anthropic named China's Z.ai, also known as Zhipu, as a company that attempted to distill capabilities from Claude while GLM-5.3 was being developed — an accusation Z.ai has not answered.
It is important to underline what is verified and what is not: all effectiveness figures come from Anthropic itself, relayed through secondary coverage from outlets including Reuters and IBTimes. No independent party has confirmed the numbers yet, and Anthropic has itself cautioned that the gains may not last.
What distillation is, and why reasoning data is worth stealing
Distillation in this context is not the controlled knowledge transfer of machine learning textbooks but an attack: a competing company generates large volumes of questions against a rival's model, captures the answers — and especially the model's reasoning traces, the step-by-step "thinking processes" modern language models produce before answering — and trains its own models on the material. The technique is cheap compared with building equivalent capabilities from scratch, because it copies a rival's work directly.
The reasoning traces are especially valuable. A model's final answer shows only the conclusion; the thinking trace shows how the model got there — the intermediate steps, error corrections, and strategies that make a model good at complex tasks. That is why Anthropic has aimed the new measures primarily at access to exactly these traces.
How the safeguards work
The reporting describes several mechanisms working together:
Preserved thinking with locked context. For the newer models Claude Fable 5.1 and Claude Opus 5.5, the "preserved thinking" feature prevents new API accounts from editing Claude's prior context. This closes a common attack path in which distillation tools manipulate the conversation history to coax out long, exposing reasoning traces.
Summarized transcripts. Instead of full thinking traces, Claude returns only summaries in some contexts. The effect on training value is significant, at least according to Anthropic's own test: a model trained on complete Claude Opus 4.8 transcripts scored 80.4 percent on SWE-bench Verified, versus 71.8 percent when trained on summarized transcripts — a gap of 8.6 percentage points on a standard software development benchmark. The test is Anthropic's own and not independently confirmed.
Two-stage classification. A two-stage classifier system is meant to detect and block extraction attempts. Anthropic claims the system is "roughly as robust as" the company's safeguards against biological weapons assistance, and that it has "a false positive rate of less than 0.1 percent" — meaning fewer than one in a thousand legitimate requests is wrongly blocked. These, too, are the company's own figures.
Enforcement at scale. Anthropic says the company has shut down tens of thousands of accounts linked to distillation campaigns, often within two hours. One proxy network previously identified by Anthropic is said to have operated more than 20,000 fraudulent accounts simultaneously.
The Z.ai accusation and the geopolitical backdrop
The naming of Z.ai is the most striking part of the announcement. Anthropic claims Z.ai attempted to distill Claude Fable 5 while building GLM-5.3, and that Z.ai switched to an older Claude model and another lab's model after Anthropic's cybersecurity measures degraded the attacks. Z.ai has not responded to requests for comment, so the accusation currently exists only from one side.
The story does not come from nowhere. Back in February, Anthropic accused the Chinese companies DeepSeek, Moonshot AI and MiniMax of having generated more than 16 million exchanges with Claude via roughly 24,000 fraudulent accounts to improve their own models. The company has also pointed to a case in which requests to Moonshot's Kimi models were allegedly secretly forwarded to Claude as part of a distillation attempt.
The timing is also politically charged. On September 17, NIST evaluators, according to Yellow.com, gave GLM-5.3 the highest cyber capability rating of any open-weight model to date, though roughly four months behind American frontier models. This makes the distillation question more than a commercial dispute: Anthropic warns that the practice poses security and national security risks.
Two unresolved matters must be noted here. First, the base models in the sources cannot be reconciled: IBTimes describes the SWE-bench test with "complete Claude Opus 4.8 transcripts," while Yellow describes distillation of "Claude Fable 5" into GLM-5.3. These cannot be reconciled from available coverage, and we report both as they appear in the sources. Second, it is unclear which American body was behind the GLM-5.3 rating: Yellow writes NIST, while other re-attributed news items mention a "US Center for Advancing Innovation and Standards for Super Intelligence." This discrepancy is also unresolved.
Trade-offs and open questions
Anthropic itself acknowledges the protection has a price. Some developers must go through integration changes, some legitimate requests are occasionally blocked, and certain blocked requests are billed anyway. For developers building on the Claude API, this means real changes in how their products can function.
The biggest open questions lie in the burden of proof. All the key figures — the 90–99 percent reduction, the 10–100 times fewer tokens, the false positive rate below 0.1 percent — rest entirely on Anthropic's own measurements. Anthropic has itself expressed uncertainty about how long the gains will last; the history of proxy networks and rapid adaptation by attackers suggests a continuous arms race rather than a lasting solution. And the accusation against Z.ai remains unanswered.
Either way, the new measures show that frontier labs now treat their reasoning data as a strategic asset to be actively defended — with locked contexts, classifiers and mass account bans, not merely terms in the terms of service.