The thing worth stealing is the reasoning
Anthropic has published an account of how it defends Claude against distillation — the practice of copying one model’s capabilities into another by harvesting its outputs at scale, usually through networks of fraudulent accounts. The company says early evidence suggests its methods have cut the data harvested by distillers by around 90 to 99%.
What distillers want, according to the post, is not Claude’s answers but its workings: transcripts of the reasoning the model writes before it responds. Anthropic puts a number on why. A model trained on full reasoning transcripts from Claude Opus 4.8 scored 80.4% on SWE-bench Verified; trained on summarised transcripts, the same model scored 71.8%.
Three defences
The first is architectural. “Preserved thinking”, introduced with Claude Fable 5.1 and Claude Opus 5.5, stops API accounts created on or after 31 August 2026 from editing Claude’s prior context — the trick that let attackers prompt the model into reproducing its own earlier reasoning verbatim. On Claude Sonnet 5.5, reasoning transcripts are visible only to the organisation whose request produced them.
The second is a two-stage classifier, derived from Anthropic’s constitutional classifiers work and running on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. Anthropic says it was red-teamed internally and externally, that its robustness is roughly on par with the company’s bioweapons safeguards, and that its false positive rate is under 0.1%. Evasions found since — translating earlier reasoning into another language, or writing it out inside tags — have been patched.
The third is economic. Accounts making repeated extraction attempts face stricter limits and bans, and since 24 September Anthropic charges for requests its safeguards block before Claude responds.
What the numbers say
Reasoning tokens extracted by distillers on Anthropic’s platform are now “consistently 10 to 100 times lower” than before, the company says, and on some days too small to measure. Tens of thousands of accounts linked to distillation have been banned, often within two hours of a campaign starting. Anthropic says it has turned away meaningful revenue and trillions of tokens of paying traffic from distillers.
The scale of the problem it describes is large. Proxy networks used hundreds of thousands of fraudulent accounts, with one running more than 20,000 at once. One lab, Anthropic says, tested 12,000 requests, each trying a different trick.
Who it names
Two companies are named. Anthropic says Zhipu distilled cyber capabilities from leading US models while developing GLM-5.3, and that after its attempts against Claude Fable 5 were degraded by Anthropic’s cyber safeguards it switched to an older Claude model and to another lab’s model. Anthropic notes that the US Center for Advancing Innovation and Standards for Super Intelligence assessed GLM-5.3 as the most cyber-capable open-weights model released to date, and says its own research found GLM-5.3’s safeguards easy to bypass.
The second is Moonshot, which Anthropic says secretly forwarded requests made to its Kimi models on to Claude. In one of those forwarded requests, Anthropic says, a user it believes to be affiliated with China’s People’s Liberation Army asked Claude to analyse CCTV surveillance of a specific individual.
What Anthropic concedes
The company expects a “cat-and-mouse game” and says it does not know how long the gains will hold, adding that it has not yet seen a highly sophisticated, persistent attempt to get around the defences. There are costs to legitimate users too: preserved thinking forces some developers to update their integrations, and the classifier occasionally blocks benign requests that are now billed anyway.
The argument Anthropic ends on is about the industry rather than itself. Distillers spread their traffic across APIs, third-party clouds and other inference providers, and the incentives discourage defending against them, because defences are expensive and illicit distillers still pay their bills. Publishing the method, the company says, is meant to show that a workable alternative exists.
