Anthropic says new safeguards have reduced the amount of data harvested from its Claude models in illicit “distillation” attacks by roughly 90 to 99 per cent.

The California-based AI company published the estimate Monday, October 12. The figure is Anthropic’s own measurement rather than an independent audit, and the company cautioned that it has not yet faced a highly sophisticated, persistent attempt to defeat the new controls.

What an illicit distillation attack does

Model distillation is a legitimate technique in which a smaller model learns from the outputs of a larger one. Anthropic defines illicit distillation as a covert, industrial-scale effort to copy another developer’s model capabilities without authorization, often through networks of fraudulent accounts.

The company says reasoning traces are especially valuable because they reveal how a model works through a problem, not only the final answer. Anthropic argues that stolen reasoning can help another developer reproduce advanced coding, analysis and agent capabilities more quickly and cheaply while leaving behind the original model’s safety controls.

Anthropic previously attributed campaigns targeting Claude to several China-based AI labs. Its latest post again named Z.ai, also known as Zhipu, and alleged that the company attempted to extract cyber capabilities while developing its GLM-5.3 model. Reuters said Z.ai did not immediately respond to a request for comment.

Three layers of defence

Anthropic said its new system restricts where protected reasoning can be moved, uses a two-stage classifier to detect extraction attempts and imposes limits or bans when accounts repeatedly probe for hidden reasoning.

The company says the classifier is used on its most capable generally available models. It also introduced “preserved thinking,” which prevents newer API accounts from editing parts of the context that precede protected reasoning, a tactic attackers had used to try to make Claude disclose hidden material.

According to Anthropic, reasoning tokens extracted by suspected distillers fell by a factor of 10 to more than 100 after the changes. It says tens of thousands of linked accounts have been banned, sometimes within two hours of a campaign starting. The company reports a false-positive rate below 0.1 per cent for the classifier.

Early gains come with trade-offs

Anthropic said some legitimate developers have had to update integrations, a small number of benign requests may be blocked and users are now charged for certain requests stopped by high-confidence safeguards before Claude responds.

The company also warned that the gains may not last as attackers adjust. It described the work as an ongoing contest and said other model developers and cloud platforms need to detect abuse and remove fraudulent accounts quickly.

OpenAI disclosed a separate coordinated model-distillation campaign in September and said it shared findings with industry partners through the Frontier Model Forum. Together, the reports show that illicit distillation is a broader industry-security issue rather than a problem confined to one model provider.

Why it matters in Canada

Canadian developers, businesses and public institutions increasingly rely on frontier AI services and third-party platforms. Stronger extraction controls may reduce the risk that powerful capabilities are copied without their safeguards, but integration changes, blocked requests and account-verification requirements can also affect legitimate users. The results should therefore be treated as an early company-reported security improvement, not proof that the threat has been eliminated.

Sources: Anthropic research post, October 12; Reuters, October 13 at 1:07 a.m. UTC; Anthropic threat-intelligence report, September 2026; OpenAI, September 30; Wikimedia Commons image page.

Lead image: Claude AI symbol supplied by Anthropic via Wikimedia Commons, CC0. Logo used illustratively.