Anthropic says new defences cut the Claude reasoning distillers can extract by 10 to 100 times

Anthropic said on 12 October 2026 that new defences against distillation attacks, covert campaigns that harvest a model's outputs to train a copycat, have cut the amount of Claude reasoning that distillers can extract on its own platform by a factor of 10 to 100 or more. Anthropic says early evidence suggests the data harvested by distillers has fallen by around 90 to 99 percent. The company describes three layers. First, "preserved thinking" with Claude Fable 5.1 and Claude Opus 5.5 stops API accounts created on or after 31 August 2026 from editing Claude's prior context, and with Claude Sonnet 5.5 reasoning transcripts are readable only by the organisation whose request produced them. Second, a two-stage classifier that blocks attempts to extract hidden reasoning, which Anthropic says is roughly as robust as its bioweapons safeguards, with a false positive rate below 0.1%. Third, stricter limits and bans for repeat offenders; Anthropic says it has banned tens of thousands of accounts, often within two hours of a campaign starting. Anthropic also illustrates why reasoning matters: a model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, against 71.8% when trained on summarised ones. It names Zhipu as having distilled cyber capabilities from US models for GLM-5.3. It admits trade-offs: some developers had to update integrations, and since 24 September it charges for requests its safeguards block before Claude responds. Anthropic says it has not yet seen a highly sophisticated, persistent attempt to get around the new measures.