Image: Anthropic

Anthropic says it has found a way to stop rival AI labs from quietly copying Claude. In a new research post, the company claims its latest defenses have cut the amount of data harvested by so-called distillers by around 90 to 99 percent.

Over the last few months, we’ve made significant progress in reducing the effectiveness of distillation attacks against Claude.

In this post, we explain how: https://t.co/uWiRSLBuOS

— Anthropic (@AnthropicAI) October 12, 2026

Distillation is when one company feeds millions of prompts to a stronger model, collects the answers, and uses them to train its own cheaper model. Done with permission, it is a normal technique. Anthropic is talking about covert campaigns run through networks of fake accounts, which it says help overseas labs keep pace with US companies at a fraction of the cost.

The most valuable prize is Claude's reasoning, the step-by-step thinking it writes out before answering. That shows a copycat model how Claude gets to an answer, not just what the answer is.

Anthropic's first fix was to show users only a summary of that reasoning. In its own test, a model trained on full Claude Opus 4.8 transcripts scored 80.4% on the SWE-bench Verified coding benchmark. Trained on summaries, it scored 71.8%.

Image: Anthropic

That chart says more than Anthropic spells out. The copycat trained on full transcripts landed just below Claude Opus 4.5 on the dashed reference lines, and even the summary-trained one scored above Claude Haiku 4.5. In other words, stolen reasoning alone could get a pretrained model close to a recent Claude flagship, which explains why Anthropic is guarding it so hard.

Summaries were not enough, though. Anthropic says distillers began tricking Claude into revealing its hidden reasoning, from simply asking it to repeat its thinking word for word to one lab testing 12,000 different tricks. Some ran proxy networks controlling hundreds of thousands of fraudulent accounts.

The new defenses work in three ways. First, newer models stop new API accounts from editing Claude's earlier context, block older models from reading their reasoning, and on Claude Sonnet 5.5 only the organization that made a request can see its reasoning. Second, a two-stage classifier, the same kind Anthropic uses against bioweapons requests, catches extraction attempts. Anthropic says it wrongly flags fewer than 0.1% of normal requests. Third, accounts that keep trying face tighter limits and bans.

Image: Anthropic

Anthropic's own chart shows reasoning exposed to distillers on its platform averaging 8,800 times the quietest day before the safeguards, versus 135 times after. That is roughly a 65-fold drop, within the 10 to 100 times range the company gives. It says it has banned tens of thousands of accounts, often within two hours of a campaign starting.

The company also names names. It says Zhipu distilled cyber skills from US models while building GLM-5.3, and switched away from Claude Fable 5 after its safeguards got in the way. It also links Moonshot's Kimi models to a scheme that secretly forwarded requests to Claude.

None of these figures have been checked independently, and the accused labs have not responded in the post. Anthropic also admits it has not yet faced a highly sophisticated, persistent attempt to beat the new system, and expects a cat-and-mouse game.

There are costs for regular customers too. Some developers have had to update their integrations, and Anthropic now charges for the rare requests its safeguards block, even when they turn out to be harmless. Its argument is that every AI developer and cloud platform needs similar defenses, or copycats will just go elsewhere.