Anthropic said Monday that new safeguards have cut the amount of data harvested from its Claude models in so-called distillation attacks by roughly 90% to 99%, Reuters reported. The company names Chinese rivals among those behind the campaigns, which run through fraudulent accounts, and its response shows that guarding an AI model now depends on the same identity checks, fraud detection and usage limits banks and cloud providers use. Paying customers are absorbing part of the cost.

What Happened

Distillation means training one AI model on the answers of another so the copy picks up the original's skills cheaply. In a research post, Anthropic describes covert, industrial-scale campaigns that do this without permission, typically through networks of fake accounts. The most prized material is Claude's reasoning, the step-by-step thinking the model writes out before it answers. In an internal test, Anthropic found that a model trained on full reasoning transcripts scored 80.4% on the SWE-bench Verified coding benchmark, against 71.8% for one trained on summarized versions.

The post lists several layers of defense. A feature called preserved thinking stops API accounts created on or after Aug. 31, 2026, from editing Claude's earlier reasoning in a conversation. A two-stage classifier, a filter that flags suspected extraction attempts, runs on Anthropic's most capable models with a false-positive rate below 0.1%, the company says. Accounts that keep trying face tighter usage limits and then bans. Since Sept. 24, requests the safeguards block before Claude responds have been billed.

RelatedAnthropic Asks Appeals Court to Rehear Ruling Upholding Pentagon's Supply-Chain Risk Label

Anthropic says the amount of reasoning distillers can extract has fallen 10 to 100 times or more, and on some days was too small to measure. It has banned tens of thousands of accounts linked to distillation, often within two hours of a campaign starting.

The post names names. Anthropic says China's Zhipu, also known as Z.ai, distilled cyber capabilities from leading U.S. models while developing GLM-5.3. When Claude's cyber safeguards degraded those attempts, Zhipu switched to an older Claude model and another lab's model, the company says. Anthropic notes that the U.S. Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) assessed GLM-5.3 as the most cyber-capable open-weights model released to date; The Primary Wire reported on Anthropic's own testing of that model last month. The company also says requests made to Moonshot's Kimi models were secretly forwarded to Claude.

Proxy networks, which run large pools of accounts and resell access, controlled hundreds of thousands of fraudulent accounts, according to the post; one ran more than 20,000 at once. Some resold Claude in regions where Anthropic does not offer it, using false identities and stolen payment details. The post also cites a user Anthropic believes is affiliated with China's People's Liberation Army who sought help analyzing CCTV surveillance of a specific person.

These attributions are Anthropic's, and it has not published the underlying evidence. Z.ai did not immediately respond to Reuters' request for comment. No response from Moonshot was reported.

Why It Matters

Anthropic frames distillation as a security problem, not only a commercial one. Copied models may approach frontier capability without matching safeguards in areas such as biology and cyberattacks. Their skills could also end up in foreign military, intelligence and surveillance systems, the company argues. Its findings echo OpenAI's earlier claim that Moonshot-linked users replayed encrypted reasoning to distill its models.

For companies building on Claude, the defenses carry practical costs. Anthropic acknowledges that some legitimate users had to update their integrations. Workflows that relied on editing earlier reasoning will not work on accounts created after the Aug. 31 cutoff. Fewer than 0.1% of benign requests may be blocked, and those are now charged. Technology leaders should check whether their applications depend on those behaviors and budget for occasional false blocks.

Anthropic says it has given up meaningful revenue and "trillions of tokens' worth of paying traffic" from distillers. It argues the defense works only if every frontier developer adopts similar safeguards, because attackers move to the weakest model. It also wants platforms and cloud providers to detect and remove fraudulent accounts quickly.

What to Watch

Anthropic says it has not yet seen a sophisticated, sustained effort to get around the new defenses and expects a cat-and-mouse contest. Signals to follow include whether OpenAI, Google and other labs publish comparable controls, and whether Zhipu or Moonshot answer the allegations. U.S. officials have already evaluated GLM-5.3, so watch also whether Washington treats model copying as a national security matter.