On October 12, Anthropic published Strengthening our defenses against distillation attacks. It reads like a security post, but it is also a changelog for anyone building on the Claude API. Several defaults changed, one pricing rule changed, and a few of them can bite an integration that was working last month.
Caveat first: every number below comes from Anthropic’s own post. I have not seen independent verification, and Anthropic itself calls this a “cat-and-mouse game.”
What distillation is, and why Anthropic cares#
Distillation here means covertly harvesting a frontier model’s outputs, usually through networks of fraudulent accounts, to train a cheaper competitor. Anthropic’s argument is a safety one: a distilled model can approach frontier capability without the safeguards, which matters most in biology and cybersecurity.
The post gives two examples:
- Zhipu / GLM-5.3. Anthropic says Zhipu allegedly distilled cyber capabilities from US models, and that after Anthropic’s cyber safeguards degraded its attacks on Claude Fable 5, it switched to an older Claude model and another lab’s model. Anthropic cites a CAISSI assessment of GLM-5.3 as the most cyber-capable open-weights model released so far, with safeguards that its own research found easy to bypass.
- Kimi traffic forwarded to Claude. In one case Anthropic reports that requests to Moonshot’s Kimi models were secretly relayed to Claude, including one from a user it believes was affiliated with China’s People’s Liberation Army.
These are allegations by the company that was targeted. Treat them accordingly, but note that they line up with Anthropic’s earlier distillation reporting.
Why reasoning transcripts are the prize#
The interesting technical point is that distillers want the model’s visible reasoning, not just its answers, because the transcript shows how the model got there. Anthropic’s own measurement makes the case: a model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, versus 71.8% for one trained on summarized transcripts.
So summarizing reasoning before display was the first defense. Attackers responded with active extraction: prompts that pressure Claude into spelling out its full reasoning. Anthropic says one lab tried 12,000 such requests. The tell is that ordinary users almost never ask for hidden reasoning, which makes the pattern detectable.
The three layers#
1. Control where reasoning can go.
- “Preserved thinking,” introduced with Claude Fable 5.1 and Opus 5.5, stops API accounts created on or after August 31, 2026 from editing prior context. Reasoning is also no longer readable by earlier models with weaker safeguards.
- With Claude Sonnet 5.5, reasoning transcripts are accessible only to the organization whose request produced them.
2. Block and patch.
- A two-stage classifier built on Anthropic’s constitutional classifiers research. Anthropic says it is roughly as robust as its bioweapons safeguards, with a false positive rate under 0.1%.
- It runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1, and is planned for future models that are similarly attractive to distillers.
- Specific tactics were patched, such as asking Claude to translate earlier reasoning into another language or to write it out in tags next to the answer.
3. Make repetition expensive.
- Accounts that keep trying to extract reasoning get stricter limits and may be banned.
- Since September 24, requests blocked by safeguards are billed in areas where the false positive rate is under 0.1%, distillation included.
The results Anthropic reports#
- Reasoning tokens extracted by distillers fell 10 to 100+ times after the classifier shipped; on some days the amount was too small to measure.
- Tens of thousands of distillation-linked accounts were banned, often within two hours of a campaign starting.
- Anthropic says it has turned away “meaningful revenue” and trillions of tokens of paying traffic from distillers.
The caveat that matters: Anthropic says it has not yet faced a highly sophisticated, persistent attempt to get around the defenses. A defense that works against current attackers has not been proven against determined ones.
What this means if you just build on the API#
Most teams will never trigger any of this. A few details are still worth checking:
- Preserved thinking can break integrations. If your code edits or rewrites earlier turns (trimming, re-ordering, injecting synthetic context), accounts created after August 31 may behave differently from your older ones. Test on a fresh account, not only your legacy org.
- Reasoning transcripts are org-scoped on Sonnet 5.5. Don’t build tooling that assumes another party, or a different org’s key, can read them.
- Blocked requests cost money. The under-0.1% false positive rate is small, but at high volume it is not zero. Log blocked responses and watch your bill for them.
- Don’t prompt for hidden reasoning. Asking the model to dump or translate its chain of thought is exactly the pattern the classifier is tuned to catch. If you need an audit trail, log inputs, tool calls, and outputs instead.
For spec-driven workflows this is mostly good news: your durable artifact is the spec and the test suite, not the model’s scratchpad. If your process depends on harvesting reasoning transcripts, that was always the fragile part.
The industry argument#
Anthropic closes with a call for every frontier developer and every platform that distributes model traffic to detect abuse quickly and offboard fraudulent accounts. It also names the awkward incentive: illicit distillers are paying customers. Publishing the methods is meant to show a workable alternative exists.
My take: charging for blocked requests and walking away from that revenue is the credible part of the post. It is easy to ask competitors to police their platforms; it is harder to show your own cost. The open question is whether classifier-based defense keeps working once attackers adapt, and Anthropic is honest that it doesn’t know.
Sources#
- Anthropic, “Strengthening our defenses against distillation attacks” (Oct 12, 2026)
- Anthropic, news index
