Anthropic says AI distillation attack defenses cut Claude extraction by 90% to 99%

What it is

Anthropic's October 12, 2026 blog post, as reported by Cryptonomist, describes layered defenses against distillation: covert campaigns that harvest a model's outputs, especially its reasoning transcripts, to train another model. Anthropic reports reasoning-token extraction on its platform stayed 10 to 100 times lower after the classifier deployed. This is Anthropic's own measurement, relayed secondhand.

How it works

Reasoning transcripts are the target because they transfer capability better than final answers. In Anthropic's earlier test, a pretrained Claude model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified. Training on summarized transcripts scored 71.8%.

Attackers moved from collecting ordinary responses to extracting hidden reasoning. Reported tactics:

• Proxy networks controlling hundreds of thousands of fraudulent accounts, using false identities and stolen payment details, and reselling access where Claude is unavailable.
• One network, from the February report, ran more than 20,000 accounts at once.
• Translating earlier reasoning, or reproducing it inside tags. Anthropic says updates have blocked both.
• Routing traffic to Claude behind other providers' APIs. The post says Moonshot's Kimi requests were secretly routed to Claude.

Preconditions / Affected

• Preserved thinking (Claude Fable 5.1, Claude Opus 5.5) blocks editing of prior context only for API accounts created on or after August 31, 2026. Older accounts are not covered by that rule.
• Those models' reasoning also cannot be read by older models with weaker protections.
• Claude Sonnet 5.5 limits transcript access to the organization that generated it.
• The two-stage classifier runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1.

What to do

Mostly relevant if you build on Claude's API, or run a cloud or inference platform.

• API users: Some safeguards have required legitimate users to update their integrations. If your workflow edits earlier context or shares transcripts across organizations, expect friction on newer accounts and models.
• Billing: Since September 24, 2026, requests blocked before Claude responds are charged. This covers categories including distillation, where Anthropic cites false positives below 0.1%. Check whether your usage could trip a block.
• Platforms: Anthropic asks cloud platforms and inference providers, where distillers spread their traffic, to detect abuse and remove fraudulent accounts. The page gives no detection queries or indicators.

Caveats

• All effectiveness figures (10 to 100x reduction, under 0.1% false positives, tens of thousands of bans, often within two hours of a campaign starting) are Anthropic's self-reported numbers. The article cites no independent verification beyond internal and external red-teaming.
• Anthropic says the classifier catches every technique in its September report. That claim covers only known techniques.
• The article says the defenses cost Anthropic revenue and paying traffic.
• Attribution claims come from Anthropic's blog: Zhipu allegedly tried to extract cyber capabilities from Claude Fable 5 for GLM-5.3, then switched to an older Claude model and another lab's model. The article also says the US CAISSI (which NIST calls CAISI) judged GLM-5.3 the most cyber-capable open-weights model so far.