Anthropic says its latest defenses are making it significantly harder for competitors to extract Claude's reasoning capabilities.
The AI developer reported that new protections reduced the volume of reasoning tokens collected by suspected unauthorized extractors by 90% to 99%. The measures target model distillation attacks, in which developers use outputs from advanced AI systems to train competing models.
According to the company, illicit actors routinely mount "covert, industrial-scale campaigns" to siphon advanced problem-solving traces from its Claude models to train cheaper knockoffs. After rolling out targeted protections, Anthropic said the number of internal reasoning tokens harvested by suspected extractors dropped to between one-tenth and one-hundredth of earlier volumes.
The defensive blitz comes as the technological rivalry between the United States and foreign AI teams grows sharper. Anthropic, joined in its complaints by peers like OpenAI and Google parent Alphabet, warns that unauthorized distillation allows overseas operations to bypass massive research expenditures while stripping away vital safety guardrails.
Locking down Claude’s inner monologue
Distillation attacks lean heavily on capturing a model’s step-by-step thinking traces rather than merely cataloging final answers. A model trained on complete reasoning transcripts from Claude Opus 4.8 reached 80.4% on the SWE-bench Verified coding benchmark, compared to 71.8% when trained on summarized transcripts, according to Anthropic.
To stop that flow, the company deployed a three-part defense:
- Preserved thinking protections: Restricts new API accounts created on or after August 31, 2026, from modifying prior context windows, preventing proxy networks from passing internal reasoning traces between models or conversations.
- Two-stage classifier: Uses a screening architecture boasting a false-positive rate under 0.1% that Anthropic claims is "roughly as robust as those that prevent Claude from helping build bioweapons."
- Account takedowns and penalties: Automatically bans offending accounts, frequently within two hours of suspicious runs, and bills clients for blocked extraction requests.
Anthropic alleges Chinese AI developer Zhipu, also known as Z.ai, as one company that targeted Claude while building its GLM-5.3 system. The firm also reported instances where requests submitted to Moonshot’s Kimi models were covertly rerouted to Claude, including surveillance inquiries tied to Chinese military personnel.
Why AI model distillation matters
For AI developers, unauthorized distillation presents both a commercial and security challenge.
Training a frontier AI model requires substantial investment in computing infrastructure, research, and development. Extracting detailed outputs from an existing model could allow another developer to reproduce some of its capabilities without making the same investment.
Anthropic also argues that unauthorized distillation can undermine safety protections if competing systems reproduce useful capabilities without retaining the safeguards built into the original model.
The company's latest defenses reflect a broader effort among AI developers to protect their models against systematic extraction while continuing to offer access through commercial APIs.
What Claude API users should know
Anthropic's new protections primarily target suspected attempts to extract Claude's reasoning capabilities at scale. However, developers using advanced API features should review whether the changes affect their applications.
Teams that rely on preserved thinking or reuse model-generated reasoning across requests should check Anthropic's current API documentation for any applicable restrictions.
Organizations should also review how they manage API credentials, monitor unusual request patterns, and handle account enforcement notices.
For legitimate customers, the key question is whether Anthropic can prevent large-scale extraction without disrupting authorized applications. The company reports substantial reductions in suspected extraction activity, but those figures alone do not establish how the protections affect ordinary API users.
Other news: A major breach of Denmark's population registry has raised concerns about weak passwords and third-party access, with reports suggesting the attacker used AI-generated code to automate millions of searches.