Anthropic says its new defenses cut the data distillers extract from Claude by around 90-99%
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
Anthropic claims that pulling training material for copycat models out of Claude is now far harder: its first estimates point to a drop in collected data of between about 90% and 99%. The protection concentrates on the reasoning that precedes each answer, using a two-stage classifier and fast account bans. According to the company, the price has been giving up paid traffic and having some customers rework integrations.
Anthropic says it has made substantial headway against distillation attacks on Claude, its AI model.
On Monday, October 12, the company published an article describing these attacks as hidden campaigns, run at industrial scale, that pull the capabilities out of one model to reproduce them in another without its developer's permission, often through networks of fraudulent accounts. According to Anthropic, early evidence indicates that its new methods have cut the data distillers obtain by roughly 90% to 99%.
The defenses are aimed almost entirely at protecting the reasoning Claude writes before it answers, which the company says is the most valuable material for training a copycat model. They work in three ways. The first limits where that reasoning can travel: with Claude Opus 5.5 and Claude Fable 5.1, new API accounts (those created from August 31, 2026) cannot edit Claude's earlier context. The second is a two-stage classifier system that spots extraction attempts, with a false positive rate below 0.1%. The third tightens usage limits and bans accounts that keep trying; in addition, since September 24 Anthropic has again been charging for requests that its safeguards block before Claude responds in the areas, distillation among them, with that same error rate.
With the classifier in place, the company estimates that the reasoning tokens extracted on its own platform are 10 to 100 times fewer than before, and says it has banned tens of thousands of accounts, often less than two hours after they start a campaign.
Anthropic states that Zhipu, for example, distilled cybersecurity capabilities from leading American models while it was building GLM-5.3, its open-weights model. According to the article, it tried to do so with Claude Fable 5 and, on finding that the cybersecurity safeguards weakened its attacks, moved to an older Claude model and to one from another lab.
The company also admits a cost: it has given up significant revenue and turned down paying traffic from distillers worth trillions of tokens, and some legitimate users have had to update their integrations. Nor does it consider the problem solved: it acknowledges that it does not know how long the improvement will hold and that it has not yet seen a highly sophisticated, persistent attempt to get around the new defenses.
Why it matters · analysis and opinion
A model's reasoning stops being a visible by-product and starts being treated as the asset that has to be guarded. For anyone building on the Claude API, that has practical effects: integrations that edit the earlier context of a conversation may need changes, and requests stopped by the filter are billed again. The practical step is to review how each application handles reasoning blocks and to check whether the account predates or postdates the cutoff set by the company. One unknown remains, and Anthropic itself admits it: the measures work against the attacks already known, but they have not yet been tested by a truly sophisticated and persistent attempt. The effectiveness, moreover, is calculated by the company on its own platform.
Official source: Anthropic · Written with the help of AI: how we make the news
