Anthropic says AI distillation attack defenses cut Claude extraction by 90% to 99%

What it claims

A secondhand news report on Anthropic's October 12, 2026 blog post. Anthropic says its anti-distillation measures reduced reasoning-token extraction on its platform by 10x to 100x after the classifier was deployed. The post also says enforcement has banned tens of thousands of distillation-linked accounts, often within two hours of a campaign starting. For an engineer building on the Claude API, the more relevant content is in the behaviour changes. They affect legitimate integrations and billing, not just attackers.

How it works

• Preserved thinking (Claude Fable 5.1, Claude Opus 5.5): API accounts created on or after August 31, 2026 cannot edit Claude's previous context. Reasoning from these models also cannot be read by older models that have weaker protections. You cannot pass Fable 5.1 or Opus 5.5 thinking into an older Claude model.
• Claude Sonnet 5.5: transcript access is limited to the organization that generated the transcript.
• Two-stage extraction classifier: it was red-teamed internally and externally, and its reported false-positive rate is below 0.1%. It covers Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. Anthropic says it catches every technique described in its September report. Later updates block two specific tactics:
• translating earlier reasoning
• reproducing reasoning inside tags
• Escalation: persistent extraction attempts lead to stricter usage limits, then account bans.

Evidence

• Reasoning-token extraction stayed 10–100x below pre-deployment levels. The article gives no absolute volumes and no time window.
• In Anthropic's internal test, a pretrained Claude model was trained on two kinds of Claude Opus 4.8 transcripts:
• full transcripts: 80.4% on SWE-bench Verified
• summarized transcripts: 71.8%

This is the stated reason the defenses focus on reasoning traces.

• Attacker scale cited: one lab tried 12,000 different request variants. Proxy networks controlled hundreds of thousands of fraudulent accounts. One network from the February report ran more than 20,000 accounts at once.

How to use it

Points to check if you run Claude in production:

• Billing: since September 24, 2026, Anthropic charges for requests blocked before Claude responds, in categories (distillation included) where false positives stay below 0.1%. A false positive therefore costs you money even though you get no response.
• Integration changes: the article says some safeguards have required legitimate users to update their integrations. It does not say which ones. Pipelines that do any of the following are the likely candidates:
• rewrite prior assistant or thinking context
• route reasoning between models
• share transcripts across organizations
• Account creation date matters: the preserved-thinking restriction applies to accounts created on or after August 31, 2026, so behaviour can differ between your older and newer accounts.

Limits

• This is an AI-assisted news summary of Anthropic's blog. It is not the primary source, and it includes no API parameters, error shapes or migration guidance. Read the original post or the API docs before changing code.
• All figures are self-reported by Anthropic. Examples include the false-positive rate, the extraction reduction and the claim of catching all known techniques. The article cites no independent verification.
• The claims about Zhipu (GLM-5.3) and Moonshot (Kimi) are Anthropic's allegations as relayed by the article.