On 12 October 2026, Anthropic published the results of its new defences against distillation, those campaigns that query Claude en masse to train a competing model on its responses. The initial findings, the company writes, suggest a drop of around 90 to 99% in the volume of data harvested by distillators. The text also contains an admission. In February, Anthropic said it wanted to make distillation harder without affecting the experience of legitimate customers. It now writes: "We have not fully achieved this goal."

From February to October, the target shifted to reasoning

The first alert dates from 23 February. Anthropic then accused DeepSeek, Moonshot and MiniMax of having generated more than 16 million exchanges with Claude through around 24,000 fraudulent accounts. Its countermeasures were then described as under development: protections at the product, API and model level, designed to reduce the usefulness of stolen responses "without degrading the experience of legitimate customers".

In September, Anthropic's report on malicious uses changed scale. Seven laboratories based in China are implicated, including Alibaba, credited with more than 151 million exchanges between May and July, the largest attack of this type ever measured by the company. One of them tested more than 12,000 requests, each with a different trick, to find those that made Claude's reasoning come out. On 8 September, a few days before this report, the NSA, CISA and FBI had named six Chinese companies in a joint advisory on distillation. ActuIA also drew from the report the cases linked to France and French-speaking Africa.

Reasoning is the central target: the transcripts of the thinking Claude writes before answering are worth more to a distillator than the answer alone. Anthropic gives a measure: a pre-trained Claude model, fed with the full transcripts of Claude Opus 4.8, scores 80.4% on the SWE-bench Verified coding test, compared with 71.8% when only summarised reasoning is provided. Summarisation was the first countermeasure. Distillators responded by asking Claude to copy its thinking "character by character", or by moving protected reasoning blocks from one conversation, model or account to another.

Three locks, including a classifier modelled on biological risk

The first lock concerns the circulation of reasoning. With Claude Fable 5.1 and Claude Opus 5.5, API accounts created from 31 August 2026 can no longer modify the context preceding Claude's thinking, what Anthropic calls "preserved thinking". Older, less protected models can no longer read this reasoning, and with Claude Sonnet 5.5 it is only accessible to the organisation whose request produced it.

The second is a two-stage classifier, of the type already used to block assistance with biological weapons. Anthropic subjected it to internal and external attack teams, and now judges it roughly as robust as those biological safeguards, with less than 0.1% false positives. It runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, Claude Fable 5 and 5.1. Patches have already closed variants that appeared later, such as asking Claude to translate its reasoning into another language.

The third targets repetition. Accounts that insist face stricter usage limits, then are banned. Anthropic says it has banned tens of thousands, often less than two hours after the start of a campaign. Since 24 September, it has also resumed billing for requests blocked before any response, in areas where the false positive rate remains below 0.1%, including distillation.

A result measured only on Anthropic's platform

The 90 to 99% drop is based on a single measure: the number of reasoning tokens extracted, which Anthropic estimates is 10 to 100 times lower than before the classifier. On some days, it was too low to be measured. This measure only covers Anthropic's platform, while the same text recalls that distillators spread their traffic between its API, third-party clouds and other inference providers. The company presents it as an early indication, says it does not know how long these gains will last and acknowledges it has not yet seen an attempt that is both highly sophisticated and persistent to circumvent these defences.

According to Anthropic, the Chinese laboratory Zhipu, known outside China as Z.ai, distilled the cyber capabilities of American models during the development of GLM-5.3: it first targeted Claude Fable 5, then fell back on an older Claude and on another laboratory's model when the safeguards degraded its attacks. On 17 September, CAISI, the evaluation centre attached to NIST, judged GLM-5.3 "the most capable open-weight model in cyber published to date", about four months behind the American frontier. On 29 September, Anthropic showed that GLM-5.3's safeguards gave way, in its simulated tests, in 64 to 100% of cases to simple techniques.

Developers pay part of the bill

As of 13 October, the Claude platform release notes detail what changes in the code: on Claude Fable 5.1, for an account created from 31 August, returning a reasoning block after modifying the system prompt, tools or a previous message produces a 400 error; a reasoning block from Claude Sonnet 5.5 sent from another, unlinked account is deleted before the model sees it. Added to this are benign requests wrongly blocked, less than 0.1% according to Anthropic, which are now billed.

Anthropic says it has given up significant revenue and "trillions of tokens" of paying traffic from distillators. It is also passing part of the cost of protection to its customers. For a company building agents on the API, this means integrations to rework and billed refusals, in exchange for protection whose benefit goes above all to the provider and, according to its argument, to American national security.

A week of announcements aimed at Washington

The publication closes a tight series. On 8 October, Anthropic launched the Anthropic Cyber Mission, which helps defenders of critical infrastructure and analyses open-source software for free, and committed $150 million over three years to provide Claude to more than 15 federal agencies of the Genesis Mission. On 9 October, a report on unintended actions of its models led it to cut internet access to all its internal evaluations, while it checked its monitoring systems.

Most of these texts present Anthropic as a provider that protects itself and protects the American state, the very week it commits to federal agencies. The distillation section is the only one to acknowledge a cost to its own customers. The end of the distillation text addresses others, cloud platforms and model developers: its efforts would be in vain, the company writes, if attackers could use models as capable and less protected, as Zhipu did for GLM-5.3.

Our articles will then appear first in Google Top Stories.