On Anthropic's own count, less data is leaving
On October 12, Anthropic published an account of how it has reduced distillation against Claude. The post says new methods in recent months have reduced the amount of data harvested by distillers by around 90 to 99 percent. That is early evidence about harvested data, not a score on a public benchmark.
After the classifier, Anthropic estimates that the reasoning tokens distillers extract on its own platform are consistently 10 to 100 times lower than before. On some days the amount was too small to measure. The post says this adds to the preserved-thinking changes. The company has used the defenses to ban tens of thousands of accounts associated with distillation, often in less than two hours after such an account begins a campaign.
The post says Anthropic does not yet know how long these gains will last. It expects distillation to remain a running contest, and it has yet to see a highly sophisticated and persistent attempt to circumvent the new defenses.
[1]
Three changes, without the attack steps
Anthropic splits the defenses in three. The first limits where reasoning can go. Claude Fable 5.1 and Claude Opus 5.5 added preserved thinking: API accounts created on or after August 31, 2026 cannot edit Claude's prior context. With Claude Sonnet 5.5, reasoning transcripts are accessible only to the organization whose request produced them. Earlier models with weaker defenses also cannot read these models' reasoning.
The second is a two-stage classifier on the strongest generally available models: Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. Anthropic says the false positive rate is less than 0.1 percent, and that the safeguards are roughly as robust as those that prevent Claude from helping build bioweapons. The post says the classifier now catches the distillation techniques described in the September report. The company plans to use it on future models that would be similarly attractive to distillers.
The third targets repeated attempts. Users who keep trying to extract reasoning face stricter usage limits, and repeated, persistent attempts lead to bans. Since September 24, in areas with a false positive rate under 0.1 percent, including distillation, Anthropic again charges for requests its safeguards block before Claude responds.
[1]Legitimate users do not get a free pass
In February, Anthropic wrote that it wanted to make distillation harder without affecting legitimate users. This post says that goal has not been met completely. Preserved thinking has required some developers to update their integrations. The classifiers can misidentify or block benign requests in fewer than 0.1 percent of cases, and those blocked requests are now billed.
An earlier step was to show users a summary of the reasoning. In Anthropic's evaluation, a pretrained Claude trained on full transcripts from Claude Opus 4.8 scored 80.4 percent on SWE-bench Verified; with only the summarized transcripts it scored 71.8 percent. Summaries made the transcripts less useful for distillation, and attackers then tried to obtain the full reasoning. The post presents the later classifier as the response, and says the first, simpler safeguards were not enough.
The post also says Zhipu tried to distill Claude Fable 5 while developing GLM-5.3. After cyber safeguards degraded those attempts, the company switched to an older Claude model and another lab's model. CAISSI has since assessed GLM-5.3 as the most cyber-capable open-weights model released to date. That is a cited assessment, not a score from this defense experiment.
[1]