Anthropic says new barriers cut the reasoning rivals can copy by about 90 to 99 percent

The post is dated Oct. 12, 2026. Distillation, as Anthropic uses the word, means drawing millions of answers out of a stronger model and training a weaker one to mimic them, without the first company’s permission. The valuable target is the reasoning transcript, not only the final answer.

An earlier defense had Claude summarize that reasoning before users saw it. Anthropic says a model trained on full transcripts of Claude Opus 4.8 scored 80.4 percent on a coding benchmark, SWE-bench Verified, and a model trained on the summaries scored 71.8 percent. Attackers then tried to force the full text out, including by telling the model to print its prior reasoning verbatim. The company says simple filters were not enough, and that proxy networks ran hundreds of thousands of fraudulent accounts.

The new stack has three parts. Preserved thinking, on Claude Fable 5.1 and Claude Opus 5.5, stops new programming-interface accounts created on or after Aug. 31, 2026, from editing Claude’s prior context. Anthropic also stopped those models’ reasoning from being read by older models with weaker defenses, and limited Sonnet 5.5 transcripts to the organization that produced them. A two-stage classifier, of the kind the company has described for constitutional classifiers, runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. Anthropic says it now catches every distillation technique described in the company’s September report, with a false-positive rate under 0.1 percent. Accounts that keep trying face tighter limits and bans. Since Sept. 24, Anthropic says it again charges for requests the safeguards block before Claude answers, in areas including distillation where that false-positive rate holds.

After the classifier, the company says, reasoning tokens extracted by distillers on its platform are consistently 10 to 100 times lower than before. It says it has banned tens of thousands of accounts, often in less than two hours. It also says it does not yet know how long the gain will last, and that it has not yet seen a highly sophisticated effort to route around the new filters.

The tradeoffs are in the post. Preserved thinking forced some developers to change their integrations. The classifier can block a benign request. Blocked requests now cost money. Anthropic says it has turned away revenue and a large volume of paying traffic.

The post also makes claims about other companies. It says Zhipu distilled cyber capabilities from leading U.S. models while building GLM-5.3, tried Claude Fable 5, and switched to an older Claude model and another lab’s model after the safeguards degraded the attacks. It says a U.S. office, the Center for Advancing Innovation and Standards for Super Intelligence, has assessed GLM-5.3 as the most cyber-capable open-weights model released so far. It says requests to Moonshot’s Kimi models were forwarded to Claude, including one Anthropic believes came from a user affiliated with China’s People’s Liberation Army seeking analysis of a surveillance image. Those sentences are Anthropic’s account. This desk did not open a Zhipu, Moonshot, or Center document.