Anthropic published the details of its new defenses against distillation on October 12, 2026. In the same post, the company says the changes reduced the amount of data distillers harvested from Claude by around 90 to 99 percent, measured in reasoning tokens extracted on its own platform.
What was actually released
Distillation is the practice of training one model on the outputs of a stronger one, and labs do it themselves to build smaller, cheaper models. What Anthropic describes is the unauthorized version: networks of fraudulent accounts sending requests at industrial scale to capture the reasoning of a frontier model, then using it to teach a smaller one. Reasoning transcripts matter more than final answers here, because they show how the model reaches a result.
The defenses now work in three places.
Where reasoning can travel. With Claude Fable 5.1 and Claude Opus 5.5, Anthropic introduced preserved thinking, which stops new API accounts, created on or after August 31, 2026, from editing Claude’s prior context. Earlier models can no longer read the reasoning those models produce. With Claude Sonnet 5.5, a reasoning transcript is readable only by the organization whose request created it.
Blocking and patching extraction. Anthropic built a two-stage classifier modeled on the constitutional classifiers it uses for harmful requests, red-teamed it internally and externally, and fixed what the red teams found. The company says the system is now roughly as robust as its bioweapon safeguards, with a false positive rate of less than 0.1 percent. It runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1.
Making repetition costly. Accounts that keep trying to pull reasoning out of Claude face stricter limits and, after repeated attempts, bans. Anthropic says it has banned tens of thousands of accounts, often within two hours of a campaign starting. Since September 24, blocked requests are billed where the false positive rate holds below 0.1 percent.
| Published figure | Value |
|---|---|
| Data harvested by distillers | down around 90 to 99 percent |
| Reasoning tokens extracted on Anthropic’s platform | 10 to 100 times lower, some days too small to measure |
| False positive rate of the two-stage classifier | under 0.1 percent |
| Accounts banned for distillation | tens of thousands, often under two hours |
| Distilled model on SWE-bench Verified, full versus summarized reasoning | 80.4 percent against 71.8 percent |
The number to keep
The classifier false positive rate is stated as under 0.1 percent, and that number is doing two jobs at once. It is the safety argument for the ban, and it is the billing argument for charging requests that get blocked.
What the claim rests on
The headline figure is an internal estimate, and Anthropic says so. The company measures how many reasoning tokens distillers extracted on its own platform. Attacks routed through resold access, stolen accounts or another provider sit outside that measurement, so 90 to 99 percent describes the leakage Anthropic can see, not the leakage that exists.
The wording is tentative as well. The post calls the result early evidence, says the company does not yet know how long the gains will last, and notes that it has not yet faced a sophisticated, persistent attempt to get around the new defenses. Anthropic describes distillation as a cat-and-mouse game and says it expects attackers to find ways through.
One figure is a controlled comparison, and it deserves separating from the rest. Anthropic tested a pretrained model on transcripts from Claude Opus 4.8: trained on the full transcripts it scored 80.4 percent on SWE-bench Verified, and on summarized transcripts 71.8 percent. That measures the value of a training set, not the volume of extraction, and it is the kind of number a buyer can follow the logic of.
The ban figure arrives with no denominator. Tens of thousands of accounts is a large number, published with no period attached, no appeal rate and no count of how many legitimate accounts were caught inside it.
We don’t yet know how long these gains will last.
On this page
What it changes for teams building on Claude
If your product calls Claude, the changes land on your integration, not only on the attackers.
The first is preserved thinking. Anthropic says the measure required some developers to update their integrations. Any pipeline that carries a reasoning block across conversations, across accounts, or from a smaller model to a bigger one should be tested, because that is the pattern the defense is built to break. We have already seen how quickly this kind of safeguard meets a workaround: it is the same ground as Anthropic finds 4 ways Claude went around its own controls.
The second is billing. A request that the classifier blocks before Claude answers is now charged, in the areas where the error rate is under 0.1 percent, distillation among them. For a single chat that is a rounding error. For a batch job running millions of reasoning calls, it is a new line on the invoice, and it arrives without the answer that was requested.
The third is the end of transcript sharing. On Sonnet 5.5 a transcript belongs to the organization that produced it, so an architecture that reads one account’s reasoning from another has to be redesigned.
Anthropic also says it has turned away meaningful revenue and trillions of tokens of paying traffic from distillers, and has not fully met its February goal of sparing legitimate users from any change.
The Neural Minute take
Distillation is the discount model of this market. A smaller model trained on a frontier model’s reasoning can approach the frontier without paying for the training run, which is why cheap models show up so fast after an expensive launch. When a lab closes that door, the cost of copying goes up, and the floor under cheap models goes up with it. Anyone buying on price alone should notice.
What we would do with this post is narrower. The figure to instrument is not 90 to 99 percent, it is 0.1 percent. At a million calls, an error rate under 0.1 percent still means hundreds of blocked requests, each of them billed, each of them without an answer. Before routing a reasoning-heavy workflow through an affected model, measure your own block rate on a sample and keep the prompts that trip it, because a false positive you have not seen yet becomes a failed job in production.
The second thing worth keeping is the shape of the disclosure. The measurement is internal, the period covered by the bans is missing, and the cleanest number in the post is not the one in the title. That is not a reason to distrust the announcement. It is a reason to read the figures in the order they can carry weight: the 80.4 against 71.8 test is a method you can follow, while the 90 to 99 percent is a claim you have to accept.
Anthropic’s own framing, a cat-and-mouse game, is the honest one, and it cuts both ways: what changes is the price of copying, and that price is what the cheap tier of this market is built on.
Sources
- Strengthening our defenses against distillation attacks, anthropic.com, published October 12, 2026: https://www.anthropic.com/research/distillation-defenses
- Detecting and preventing distillation attacks, anthropic.com, published February 23, 2026, the report the October post builds on: https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks
- Figures quoted here are read on the October 12, 2026 post: data harvested by distillers down around 90 to 99 percent, reasoning tokens extracted 10 to 100 times lower, classifier false positive rate under 0.1 percent, tens of thousands of accounts banned, and the 80.4 against 71.8 percent SWE-bench Verified comparison