AI distillation attacks just got much harder to pull off — at least according to Anthropic. On October 12, 2026, the company published “Strengthening our defenses against distillation attacks,” reporting that new safeguards have cut the data harvested by distillers by an estimated 90% to 99%. Reasoning-token extraction on Anthropic’s platform is now 10 to 100 times lower than before the measures, and the company says it has banned tens of thousands of accounts linked to distillation campaigns.
The announcement, reported by Reuters, lands in the middle of an intensifying US-China AI race. Anthropic explicitly cited Chinese AI startup Z.ai — also known as Zhipu — as an example of a company that attempted to distill capabilities from Claude while developing its GLM-5.3 model, warning that the practice poses safety and national security risks.
What Anthropic announced
Anthropic’s October 12 post describes expanded safeguards aimed at one thing: making it harder to extract Claude’s reasoning and use it to train a rival model. The headline numbers:
- Data harvested by distillers: down roughly 90%–99%
- Reasoning tokens extracted: 10 to 100 times lower than before
- False-positive rate: below 0.1%
- Accounts banned: tens of thousands, linked to distillation campaigns
- Proxy networks: harder to use for repeated probing of Claude’s protected reasoning
Anthropic described its detection system as roughly as robust as the safeguards that prevent Claude from helping build bioweapons — a deliberately striking comparison meant to signal how seriously the company treats model theft. A classifier now screens traffic across Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1.
What “distillation” actually means
Distillation is not a student model learning in the open. It’s repeated, systematic probing of a stronger model — thousands of carefully crafted queries — so a rival can train a cheaper model on what comes out. Anthropic, OpenAI, and Google have all argued the practice lets competitors reproduce frontier capability faster and at lower cost, free-riding on billions in training investment.
For AI businesses, the economics are the point: if a rival can clone your model’s reasoning for the price of API calls, your moat evaporates. That’s why Anthropic’s move is as much a business defense as a security measure.
The China angle
Anthropic didn’t stay abstract. It named Z.ai (Zhipu), the Chinese AI startup, as an example of a company that attempted to distill capabilities from Claude while developing its GLM-5.3 model. Z.ai did not immediately respond to Reuters’ request for comment.
The framing matters: Anthropic warned that distillation practices pose safety and national security risks, not just commercial ones. Distilled models can inherit advanced capabilities without inheriting the safety training that constrains the original — meaning a cheap clone could be both capable and less safe than the model it copied.
What it means for Claude API users and AI businesses
The safeguards have real consequences for legitimate developers. Anthropic acknowledges that some benign requests can still be blocked, and developers may need to update integrations. Some reports indicate Anthropic charges for certain requests blocked before Claude responds — so heavy API users should watch their dashboards for new block patterns and unexpected charges.
Three practical takeaways
1. Audit your Claude API usage. If your product leans on Claude’s reasoning traces, check whether the new classifier is flagging your traffic. Preserved-thinking controls now apply to specified new API accounts.
2. Don’t build on borrowed reasoning. Training your own model on a frontier lab’s outputs was always against the terms — now it’s actively policed at scale. The tens of thousands of banned accounts are the warning shot.
3. Price the moat. For investors, this is Anthropic defending its core asset: the billions spent training Claude. Companies that can protect their models’ reasoning protect their pricing power.
Why this matters beyond Anthropic
Every frontier lab faces the same threat. OpenAI and Google have made the same argument about distillation enabling cheaper, faster rivals. Expect similar safeguards — and similar ban waves — across the industry. The era of quietly cloning frontier models through their APIs is closing, and the labs with the best detection systems get to keep their lead longest.
FAQ
What is an AI distillation attack?
It’s the repeated, systematic probing of a strong AI model so a rival can train a cheaper model on its outputs — effectively copying capabilities without paying the training cost.
How much did Anthropic reduce distillation?
Anthropic estimates data harvested in distillation attacks is down about 90% to 99%, with reasoning-token extraction on its platform 10 to 100 times lower than before the safeguards.
Did Anthropic name any company?
Yes — it cited Chinese AI startup Z.ai (Zhipu) as an example of a company that attempted to distill capabilities from Claude while developing its GLM-5.3 model.
Will this affect legitimate Claude API users?
Possibly. Anthropic says some benign requests can be blocked, developers may need to update integrations, and certain blocked requests can still incur charges. The false-positive rate is below 0.1%.
Why does distillation matter for the AI business?
Distillation lets rivals reproduce frontier capabilities faster and cheaper, eroding the training-investment moat of labs like Anthropic, OpenAI, and Google — and potentially producing capable but less-safe clones.
Sources: alfw.ai’s analysis of Anthropic’s October 12 announcement, Reuters’ report on the new safeguards, and NeoTeo’s breakdown of the classifier coverage and API impact.