Anthropic shuts down tens of thousands of accounts and says distillation against Claude is sharply reduced
The figures are the company's own measurements, but the scale of the attacks — nearly 200 million exchanges across five campaigns, as measured by Anthropic itself — offers a rare glimpse into how AI labs are now working to stop competitors from copying their models. At the same time, Anthropic is advancing serious allegations against China's Zhipu that no independent party has confirmed.
The news
On 12 October 2026, Anthropic published the research post "Strengthening our defenses against distillation attacks", in which the company claims that new defense methods have reduced the amount of data distillation attackers manage to harvest from Claude by roughly 90 to 99 percent. Reuters covered the story on 13 October (Anthropic, Reuters via ETEnterpriseAI).
The company further states that the volume of reasoning tokens attackers now extract is 10 to 100 times lower than before, and that tens of thousands of accounts linked to distillation campaigns have been shut down (Reuters).
It is important to keep the figures what they are: They come from Anthropic's own measurements and its own red-team testing. No independent verification exists. The blog post's own wording is also cautious — "early findings" indicate a reduction; it is not a final result. The details about the defense layers beyond summarized reasoning rely mainly on secondary summaries from Times of AI and IJR (Times of AI, IJR).
What distillation attacks are
Anthropic defines distillation attacks as covert, industrial-scale campaigns to extract the characteristics of one model and copy them into another, without authorization from the original model's developers (Anthropic; the definition is translated from English). In practice, this means large volumes of fake accounts that pose questions to Claude, store the answers — especially the detailed reasoning transcripts — and use them as training data for a competing model.
The scale is not hypothetical, if Anthropic's own figures are to be believed. In the company's threat intelligence report from September 2026, Anthropic itself attributed nearly 200 million exchanges to five distillation campaigns. More than 151 million of these were linked to Alibaba's Qwen (IJR). Anthropic also describes a shift from passive harvesting to active extraction: one laboratory is said to have tested 12,000 different queries, each crafted to trick the model into revealing hidden reasoning in a new way (IJR).
How the defense works
The defense is built in multiple layers, targeting different parts of the extraction chain.
Summarized reasoning. At the core, Claude no longer serves complete reasoning transcripts to the outside world. Anthropic has measured the effect itself: A pre-trained Claude model trained on full transcripts from Claude Opus 4.8 achieved 80.4 percent on the SWE-bench Verified coding benchmark. With only summarized transcripts, the score fell to 71.8 percent (Anthropic). That is a performance drop for whoever distills, in Anthropic's own setup — but the benchmark is the company's own, and it is unknown how well it transfers to real-world attackers.
Preserved "thinking." According to Times of AI, what is called preserved thinking blocks new API accounts created from 31 August 2026 from editing Claude's prior context in supported models. With Claude Sonnet 5.5, the reasoning transcripts go only to the organization that owns the query (Times of AI). Editing prior context has been an extraction vector: IJR describes how attackers systematically tried to trick the model into revealing hidden reasoning through varied queries (IJR). For legitimate customers, the change means they can still see the model's reasoning, but can no longer manipulate the history in the same way.
Classification and shutdowns. Reuters reports that Anthropic's safety system has a false positive rate below 0.1 percent, and that the company describes it as roughly as robust as its safeguards against biological weapons assistance (Reuters). Queries classified as distillation attempts are blocked, and the accounts behind them are shut down.
Billing for blocked queries. From 24 September 2026, Anthropic has, according to Times of AI, begun charging customers for queries blocked before the model responds, in areas where the false positive rate is below 0.1 percent — distillation included (Times of AI). This is an economic deterrent: Running industrial distillation campaigns against Claude thus becomes not only impossible once an attack is detected, but directly costly per attempt.
Security-policy charge: Zhipu and Kimi
The blog post is not purely technical. Anthropic uses it to advance geopolitical claims that stand in a category of their own apart from the technical findings — because they are the company's accusations, not documented facts.
Anthropic claims that Zhipu distilled the cyber capabilities of leading US models during the development of GLM-5.3, and that the company attempted to distill Claude Fable 5 but switched to an older Claude model and another lab's model after finding that Anthropic's cybersecurity weakened the attacks. The company further cites the US CAISSI (Center for Advancing Innovation and Standards for Super Intelligence), which has reportedly assessed GLM-5.3 as the most cyber-capable open-weight model released to date — an assessment known here only as Anthropic itself presents it (Anthropic).
Anthropic also points to a case in which queries to Moonshot's Kimi models were allegedly secretly forwarded to Claude as part of distillation work. One query is said to have come from a user Anthropic believes was affiliated with China's People's Liberation Army, who wanted to analyze CCTV surveillance footage of a specific person (Anthropic). Here too it is worth emphasizing: The PLA affiliation is Anthropic's supposition, not a verified identification.
The sources note that Zhipu (Z.ai) did not immediately respond to requests for comment. No response from Zhipu or Moonshot appears in the source material, and no independent party has confirmed the allegations.
What remains unresolved
What remains unresolved falls into three categories.
First, all the key figures — the 90–99 percent reduction, 10–100 times fewer extracted tokens, the false positive rate below 0.1 percent — are self-measurements from the company that built the defense, which has commercial and political interests in appearing effective. Anthropic itself words it cautiously as "early findings."
Second, the durability is undocumented. Distillation attackers have already shown they adapt — from passive harvesting to systematic extraction campaigns, such as one laboratory's 12,000 variants of extraction attempts. A defense that works today is not necessarily a defense that works once attackers have adapted. The sources say little concrete about how robust the methods are against targeted counterattacks over time.
Third, the effects on customers are unclear. The changes from 31 August and 24 September 2026 in principle affect all API users, not just attackers. Preserved thinking preventing edits to prior context may change how legitimate applications orchestrate conversations. Billing for blocked queries in principle also hits anyone blocked unjustly — even though the false positive rate is claimed to be below 0.1 percent, there is as yet no external check of that figure.
The distillation war is now fully underway. Anthropic's figures are, for now, the only public yardstick for who is winning it — as measured by one of the parties involved.