Anthropic Says New Defenses Cut Distillation Harvest 90-99%
TL;DR
- Anthropic names five Chinese labs as extractors; Alibaba's Qwen campaign alone ran 151 million exchanges between May and July 2026.
- Moonshot's Kimi forwarded roughly 300,000 user requests to Claude in ten days, including one tied to PLA CCTV surveillance analysis.
- Zhipu's GLM-5.3, developed after distilling Claude's cyber capabilities, is independently assessed as the most cyber-capable open-weights model publicly released.
Reasoning transcripts, not final answers, are the prize for distillers. In an October 12 research post, Anthropic reports that a model distilled from Claude's full reasoning transcripts scored 80.4% on SWE-bench Verified, versus 71.8% when distilled from only summarized reasoning.
The company says it has cut what distillers can harvest by 90-99%, through a bundle of changes rolled into Claude Fable 5.1 and Opus 5.5. The core move is a feature called 'preserved thinking': new API accounts, created after August 31, 2026, cannot edit Claude's prior context, which the post identifies as the technique attackers use to pull long reasoning transcripts out.
The post names two Chinese labs. Zhipu is said to have been 'distilling cyber capabilities into GLM-5.3'; Moonshot's Kimi models, per the post, 'secretly forwarded' requests to Claude, including 'surveillance analysis requests potentially linked to China's People's Liberation Army'.
A two-stage classifier now covers Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1, with false positive rates 'below 0.1%'. Repeat attempters get stricter rate limits, and associated accounts are banned 'within two hours of detected distillation campaigns'. Anthropic says tens of thousands of accounts have been banned and that reasoning token extraction is down 10-100 fold. High-confidence blocked requests have been billed since September 24.
No third party has verified the 90-99% figure; the post is Anthropic's own. The company concedes 'revenue loss and substantial internal resource investment' and occasional false positives for legitimate users. It is the 344th Anthropic story we have tracked in the last 90 days.
What others are reporting
-
Reuters Read →
Wire-service dateline establishes the story beyond the AI press; Z.AI (Zhipu) 'did not immediately respond,' making Reuters the first to log the non-response on record.
Safeguards restricting access to Claude's reasoning have sharply reduced extraction attempts, with reasoning tokens extracted now 10 to 100 times lower than before.
-
The Decoder Read →
Frames the story as industrial-scale theft and notes legitimate users are caught in enforcement; the only outlet to quantify fake-account networks in the hundreds of thousands.
Attackers use networks of hundreds of thousands of fake accounts to pull it off.
-
Unite.AI Read →
Most complete campaign timeline naming all five labs with per-lab metrics, and the only outlet to surface the SWE-bench 80.4% vs 71.8% gap showing the real performance cost of extraction.
early evidence suggests the new methods have reduced the amount of data harvested by distillers by around 90 to 99 percent
-
Times of AI Read →
Highlights collateral damage to developers and Anthropic's deliberate revenue sacrifice; adds the PLA CCTV surveillance link as a national security frame beyond the commercial story.
Distillers' access to reasoning tokens has dropped by a factor of 10 to 100, or even more, since launching these new protections.
-
Crypto Briefing Read →
The only outlet to flag that distilled models may not inherit source-model safety guardrails, framing GLM-5.3 as a guardrail-stripped capability extraction.
Illicit distillation raises questions about whether the safeguards built into the original model carry over to the distilled copy.
-
Runtime Wire Read →
Frames defenses as the opening move in an industry-wide fight, warning output-level controls may eventually restrict all frontier API usage beyond just bad actors.
Frontier-model APIs can serve as an indirect training pipeline for competitors.
-
Blockchain.News Read →
Cites CAISSI as a named third-party assessor for the GLM-5.3 cyber-capability claim, providing the only independent attribution in the coverage pool.
After introducing the two-stage classifier, reasoning tokens extracted by distillers fell by a factor of 10 to 100.
Originally reported by anthropic.com
Read the original article →Original headline: Anthropic Says Distillation Defenses in Fable 5.1 and Opus 5.5 Cut Data Harvesting by 90-99%