Anthropic Says New Defences Cut the Data “Distillers” Harvest From Claude by Around 90 to 99 Percent

CONFIRMED as Anthropic’s claim: Anthropic published the figures and methods on 12 October 2026 and calls the results “early evidence”. The numbers are its own and have not been independently checked. What it says about Zhipu and Moonshot are ALLEGATIONS by Anthropic.

Anthropic says new methods to stop rivals copying Claude have, according to “Early evidence”, “reduced the amount of data harvested by distillers by around 90 to 99 percent” [1].

What is distillation?

Distillation means using a big, powerful AI model as a teacher. Someone sends it huge numbers of questions, collects the answers, and uses them to train a smaller model to behave like the big one. It is far cheaper than building the capability from scratch.

Anthropic describes “Distillation attacks” as “covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another, without the authorization of the original model’s developers”, often “conducted using networks of fraudulent accounts” [1].

The most prized material, it says, is Claude’s reasoning, “the thinking process that Claude writes out before it responds”, because it helps the smaller model understand how Claude reaches its answer. Its defences “therefore focus almost entirely on making Claude’s reasoning harder for distillers to access” [1].

Why summaries were not enough

An early defence was to have Claude summarise its reasoning before showing it. Anthropic tested this by training a pretrained Claude model on transcripts from Claude Opus 4.8 and scoring it on the SWE-bench Verified coding benchmark: “When training on the full transcripts, the distilled model achieved 80.4%; with only the summarized transcripts, it achieved 71.8%” [1].

Attackers then tried to trick Claude into revealing its full reasoning and scaled up with “proxy networks that control hundreds of thousands of fraudulent accounts”. Citing its February report, Anthropic says “one network managed more than 20,000 fraudulent accounts at once” [1].

The new defences

Anthropic says its defences now work in three ways [1]:

• Controlling where reasoning can go. With Claude Fable 5.1 and Claude Opus 5.5 it introduced “preserved thinking”, which “prevents new API accounts (those created on or after August 31, 2026) from editing Claude’s prior context”. With Claude Sonnet 5.5, “we’ve made reasoning transcripts accessible only to the organization whose request produced the transcript.”
• Blocking extraction attempts. Anthropic “built a two-stage classifier system” (an automated filter that screens requests in two steps), red-teamed it, and says it is now “roughly as robust as those that prevent Claude from helping build bioweapons”, with “a false positive rate of less than 0.1%”.
• Making repeated attempts difficult. Persistent offenders face stricter usage limits and bans. Since 24 September Anthropic has resumed charging for requests its safeguards block before Claude responds.

Anthropic says the reasoning tokens distillers extract on its platform are “consistently 10 to 100 times lower than it was before”, and that it has banned “tens of thousands of accounts associated with distillation” [1].

The cost

Anthropic says: “We’ve turned away meaningful revenue and trillions of tokens’ worth of paying traffic from distillers” [1]. Some developers have had to update their integrations, and in fewer than 0.1% of cases benign requests may be blocked and charged. It adds: “We don’t yet know how long these gains will last” [1].

Anthropic’s allegations about Zhipu and Moonshot (ALLEGATION)

Anthropic alleges that “Zhipu, for example, distilled the cyber capabilities of leading US models during the development of GLM-5.3”, and that it tried to distill Claude Fable 5 before switching “to an older Claude model and another lab’s model” [1]. Anthropic also says its own research found “GLM-5.3’s safeguards can easily be bypassed” [1].

Anthropic further alleges that “requests to Moonshot’s Kimi models were secretly forwarded to Claude as part of its distillation efforts”, including one from a user “who we believe was affiliated with China’s People’s Liberation Army” seeking to analyse CCTV surveillance of an individual [1].

TSN has not independently verified these allegations and found no response from Zhipu or Moonshot.

Sources

1. Anthropic, “Strengthening our defenses against distillation attacks”, 12 October 2026. https://www.anthropic.com/research/distillation-defenses

Related stories

• Anthropic Says Small AI Models May Be Months Away From Copying Themselves Across Cheap Smart Devices
• Z.ai Launches GLM-Legal, an Agentic Legal Model Built on GLM-5.3-Flash