On October 12, 2026, Anthropic published a post on its official research blog saying that a set of new defenses deployed over recent months is working: by its own platform monitoring estimates, the amount of data harvested by distillers has fallen by roughly 90 to 99 percent, and the number of reasoning tokens extracted is now 10 to 100 times lower than before — on some days too small to measure.
Why the defenses revolve around reasoning transcripts
In this kind of attack, distillation is not ordinary teacher-student learning. Attackers use large numbers of fraudulent accounts to query a stronger model repeatedly and train their own model on the responses. The most valuable material is the reasoning the model produces before answering: final answers alone do not teach a student model how to think, while reasoning transcripts make imitation far faster. Anthropic's earlier step was to have Claude summarize its reasoning before showing it; its tests found a model trained only on summarized transcripts scored 71.8% on SWE-bench Verified, well below the 80.4% achieved with full transcripts. Attackers then moved to active extraction, using prompts designed to make the model reveal its full reasoning, and spreading requests across proxy networks of fraudulent accounts at scale.
The three layers added this time
The new defenses work on three levels. First, controlling where reasoning can go: the preserved-thinking measure introduced with Fable 5.1 and Opus 5.5 stops API accounts created on or after August 31 this year from editing Claude's prior context, and with Sonnet 5.5, reasoning transcripts are accessible only to the organization whose request produced them. Second, blocking extraction attempts with a two-stage classifier modeled on the company's constitutional-classifier research; Anthropic says that after internal and external red-teaming, these safeguards are roughly as robust as those preventing Claude from helping build bioweapons, with a false-positive rate below 0.1%, and they now run on its most capable generally available models. Third, making repeated attempts costly and slow: accounts that persistently try to extract reasoning face stricter limits and bans — the company says it has banned tens of thousands of accounts tied to distillation, often within two hours of a campaign starting — and since September 24, requests blocked by these safeguards are charged for again.
The costs are stated openly, and the cat-and-mouse game is not over
Anthropic names Zhipu as an example, saying the company distilled the cyber capabilities of leading US models while developing GLM-5.3, tried Claude Fable 5 first, and switched to an older Claude model and another lab's model after finding its cyber safeguards degraded the attacks. Zhipu does not respond in the post, so for now that part rests on Anthropic's account alone. Anthropic also concedes the costs: it has turned away meaningful revenue and trillions of tokens of paying traffic, some legitimate developers had to update their integrations, false positives below 0.1% still exist and blocked requests are billed anyway, and it says plainly that it has yet to face a highly sophisticated, persistent circumvention attempt. For other model developers, the real pressure in this post is simple: if a rival model's guardrails are visibly weaker, attackers will route around the strong ones, and one vendor's defenses can be undone by the industry's weakest link.
