Anthropic says new security measures have reduced the amount of reasoning data extracted from its Claude AI models by unauthorized distillation campaigns by approximately 90% to 99%. The company announced the results on October 12, 2026, describing a combination of technical safeguards, attack detection systems and account enforcement measures designed to make it harder for rival developers to replicate the capabilities of its advanced AI models.
The announcement highlights a growing security challenge for the artificial intelligence industry: preventing other developers from using a powerful model’s responses to train competing systems without authorization. Anthropic says its latest defenses have significantly reduced the effectiveness of these attacks, although it expects the methods used by attackers to continue evolving.
What Happened?
In its latest research update, Anthropic detailed how it has strengthened protections against AI model distillation attacks targeting Claude.
Model distillation is a technique in which developers use outputs from a more capable AI system to train another model to reproduce similar behavior. The technique can be legitimate when conducted with appropriate authorization. Anthropic’s announcement focuses on unauthorized campaigns that systematically extract valuable information from its models to replicate their capabilities.
According to Anthropic, some campaigns attempt to collect millions of model responses through large networks of accounts. The company says attackers have also developed methods to bypass basic safeguards and obtain more detailed reasoning transcripts, which can provide particularly useful training material.
Anthropic’s new measures focus on preventing access to protected reasoning data, detecting extraction attempts and disrupting repeated abuse.
How Anthropic’s New AI Safeguards Work
Anthropic says its updated defenses operate across three main areas.
1. Restricting Access to AI Reasoning Data
One of the company’s priorities is preventing attackers from retrieving detailed reasoning transcripts through manipulated conversations, account switching or interactions with models that have weaker safeguards.
Anthropic introduced a mechanism called preserved thinking for Claude Fable 5.1 and Claude Opus 5.5. For new API accounts created on or after August 31, 2026, the measure prevents users from editing Claude’s prior context in ways that could help extract protected reasoning.
The company has also introduced restrictions on how reasoning transcripts can be accessed across models and organizations. For Claude Sonnet 5.5, these transcripts are accessible only to the organization whose request generated them.
These changes are intended to close gaps that could otherwise allow attackers to move protected information between conversations, accounts or models.
2. Detecting and Blocking Extraction Attempts
Anthropic has developed a two-stage classifier system designed to identify requests that attempt to extract protected reasoning.
The company says it tested the safeguards through internal and external red-teaming, using manual and automated techniques to identify weaknesses. It then updated the system to address the vulnerabilities discovered during testing.
According to Anthropic, the classifier now detects the distillation techniques described in its September report when applied to its most capable generally available models.
The company also reports a false-positive rate below 0.1%. This means that a small proportion of legitimate requests may still be incorrectly identified or blocked, so the safeguards are not entirely free of unintended effects.
3. Limiting Repeat Abuse and Banning Accounts
Anthropic says attackers have increasingly relied on proxy networks and fraudulent accounts to continue extraction campaigns after individual accounts are blocked.
Its response includes stricter usage limits for accounts repeatedly attempting to extract protected reasoning, alongside bans for accounts associated with persistent distillation activity.
The company says it has banned tens of thousands of accounts linked to these campaigns, in some cases within two hours of a campaign beginning.
Since September 24, Anthropic has also resumed charging for requests blocked by certain safeguards before Claude responds, including in areas where its false-positive rate is below 0.1%.
Together, these measures are intended to increase the cost and difficulty of running large-scale extraction operations.
How Did Anthropic Measure the 90%–99% Reduction?
Anthropic measured the effectiveness of its defenses by estimating the volume of Claude reasoning tokens extracted by distillers on its own platform.
The company reports that, after its new classifier was introduced, the amount of reasoning data extracted by distillers became approximately 10 to 100 times lower than before. This represents a reduction of roughly 90% to 99%, depending on the comparison.
The results build on earlier measures, including summarizing Claude’s reasoning before presenting it to users. Anthropic previously reported that a model trained on full reasoning transcripts from Claude Opus 4.8 achieved 80.4% on the SWE-bench Verified coding benchmark, compared with 71.8% for a model trained on summarized transcripts.
That earlier comparison illustrates why limiting access to detailed reasoning data may reduce its usefulness for training competing models.
However, the latest reduction figure needs context. It measures estimated extraction on Anthropic’s own platform, rather than all possible distillation activity across the AI industry. The company also acknowledges that it does not yet know how long the improvements will last.
Why AI Model Distillation Has Become a Security Concern
AI distillation can help developers build smaller, less expensive systems that reproduce some of the capabilities of larger models. When performed lawfully and with permission, it can be a useful model-development technique.
Unauthorized extraction raises different concerns for companies that invest heavily in training advanced AI systems.
First, it can allow competitors to reproduce valuable capabilities without incurring comparable development costs. Second, Anthropic argues that models created through illicit distillation may not inherit the same level of safety protections as the original systems.
The company has raised particular concerns about cybersecurity and biological risks. It also argues that powerful distilled models could be incorporated into military, intelligence and surveillance systems.
Anthropic has cited Chinese AI developer Zhipu and its GLM-5.3 model in its discussion of distillation risks. The company says Zhipu attempted to extract capabilities from Claude Fable 5 before switching to an older Claude model and another provider’s model after encountering cybersecurity safeguards.
These are Anthropic’s characterizations of the activity. The broader implications depend on how the resulting models are trained, evaluated, deployed and protected.
What This Means for AI Developers and Businesses
Anthropic’s announcement carries implications beyond its own products.
For AI developers, it demonstrates that protecting model capabilities may require more than conventional rate limits or account bans. Systems may also need to monitor suspicious request patterns, control access to sensitive outputs and detect attempts to manipulate conversation context.
For businesses using AI APIs, stronger safeguards can improve protection against unauthorized extraction. However, developers may need to update integrations to accommodate changes in how reasoning data and conversation context are handled.
Anthropic acknowledges that some legitimate customers have had to modify their integrations. It also says that a small proportion of benign requests may be incorrectly blocked and that certain blocked requests are now chargeable.
For the wider industry, the announcement raises a question about shared responsibility. Anthropic argues that model providers, cloud platforms and inference services all have a role in identifying abuse and preventing fraudulent accounts from being used to distribute extraction traffic.
What Happens Next?
Anthropic expects unauthorized distillation attempts to remain an ongoing challenge. The company says it is monitoring successful extraction attempts and updating its safeguards when it discovers new techniques that bypass existing defenses.
It also acknowledges that the durability of the latest results remains uncertain. More sophisticated attackers may develop alternative methods, requiring further technical changes and enforcement measures.
The company is encouraging other AI developers and platforms to adopt stronger protections rather than treating unauthorized extraction as an isolated problem.
Whether the reported reduction can be maintained over time will depend on how effectively Anthropic responds to new attack methods and how widely similar safeguards are adopted across AI infrastructure.
Read More:- Google Gemini Skills Start Rolling Out Today, Replacing Gems
Conclusion
Anthropic says its new safeguards have reduced unauthorized extraction of Claude’s reasoning data by approximately 90% to 99% on its own platform. The measures combine restrictions on reasoning access, improved detection systems and stronger enforcement against accounts involved in repeated extraction attempts.
The results are promising, but they do not establish that AI distillation attacks have been eliminated or that the same reduction has occurred across the industry. Anthropic expects the contest between model developers and distillation operators to continue, making ongoing security improvements and cooperation among AI providers increasingly important.
Frequently Asked Questions
What is AI model distillation?
AI model distillation is a process in which one model’s outputs are used to train another model to reproduce similar capabilities. It can be legitimate when authorized, but unauthorized extraction can raise intellectual property and security concerns.
How much have Anthropic’s safeguards reduced distillation attacks?
Anthropic says the amount of reasoning data extracted by distillers on its own platform fell by approximately 90% to 99%, equivalent to a 10- to 100-fold reduction after the new classifier was introduced.
How do Anthropic’s new safeguards work?
The measures restrict access to protected reasoning transcripts, use classifiers to identify extraction attempts and apply usage limits or account bans to persistent abusers.
Have AI distillation attacks been eliminated?
No. Anthropic says the new measures have improved its defenses, but it expects attackers to continue developing new techniques and plans to update its safeguards as necessary.
Do the new safeguards affect legitimate Claude users?
They can. Anthropic reports a false-positive rate below 0.1% for its relevant safeguards and acknowledges that some developers have needed to update their integrations. Certain requests blocked by these safeguards may also incur charges.
Why is unauthorized AI distillation a concern?
It can help other developers replicate advanced model capabilities without comparable development costs. Anthropic also warns that distilled systems may lack adequate safety protections, potentially increasing cybersecurity and other misuse risks.
