Anthropic said on Monday that new safeguards around Claude have cut the data harvested in distillation attacks by roughly 90% to 99% — a sign that frontier labs are now defending their models’ reasoning as fiercely as they defend against dangerous requests.
October 12, 2026
What happened
Anthropic announced measures designed to stop rivals from copying Claude’s capabilities through repeated probing. The company said the amount of reasoning extracted by distillers is now 10 to 100 times lower than before the safeguards were put in place.
Distillation, in this context, means using a stronger model’s outputs — especially its reasoning — to train or improve a competing model more quickly and cheaply than building that capability from scratch. Anthropic, OpenAI and Google have all raised it as a growing concern as US-China AI competition intensifies.
How Anthropic says it is blocking extraction
The company said it has restricted access to Claude’s protected reasoning and made it harder to use proxy networks to probe the model repeatedly at scale. It also said it has banned tens of thousands of accounts linked to distillation campaigns.
Anthropic put the false positive rate for its detection system at less than 0.1% and described the system’s robustness as comparable to the safeguards that stop Claude from helping with bioweapon development. Those performance figures are Anthropic’s own, reported by Reuters, and have not been independently audited in the reporting.
Z.ai named as an example
Anthropic cited Chinese AI company Z.ai, also known as Zhipu, as an example of a firm it says attempted to distill capabilities from Claude while developing its GLM-5.3 model. Anthropic framed that kind of activity as a safety and national security risk, arguing that copied capabilities can spread without the original lab’s safeguards attached.
Reuters reported that Z.ai did not immediately respond to a request for comment.
Why it matters
For readers, the practical point is simple: the moat around a frontier model is no longer just training data and chips. It is also control over reasoning traces — the step-by-step output that makes a model useful for coding, research and agent work, and that a rival would most want to harvest. If labs can reliably detect and throttle that harvesting, smaller rivals lose a shortcut, and the gap between frontier labs and fast followers gets harder to close on the cheap. Expect other labs to talk more openly about anti-distillation defenses, and expect some legitimate high-volume users to get caught in stricter account controls along the way. That is the tested reality of this phase of AI: everything AI, tested — including, now, by the labs trying to steal it.
Frequently asked questions
What is a distillation attack on an AI model?
It is a large-scale effort to extract a model’s outputs or reasoning through repeated queries, then use that material to reproduce much of the model’s capability in a cheaper competing system.
How much did Anthropic say extraction fell?
Anthropic said the reasoning tokens extracted by distillers are now 10 to 100 times lower than before — a reduction of roughly 90% to 99%.
Which company did Anthropic name?
Anthropic cited Z.ai, also known as Zhipu, in connection with its GLM-5.3 model. Reuters said Z.ai did not immediately comment.
Sources: Reuters