1. Home
2. News
3. Anthropic

Anthropic says new defenses cut the data distillers take from Claude by 90 to 99%

The company names Zhipu and Moonshot, and says honest developers are paying part of the cost.

By Think Facility · October 13, 2026 · Anthropic AI safety Save

On October 12, 2026, Anthropic said its newest defenses against distillation have cut the data distillers harvest from Claude by around 90 to 99%. The number comes from a post on Anthropic's research blog describing what it changed over the past few months.

The post names two Chinese companies. Anthropic says Zhipu distilled the cyber skills of leading US models while building GLM-5.3, and that requests sent to Moonshot's Kimi models were secretly forwarded to Claude.

Published

Oct 12, 2026

Data harvested by distillers

around 90 to 99% less

Reasoning tokens extracted

10 to 100 times lower

False positive rate

less than 0.1%

Companies named

Zhipu and Moonshot

Why the reasoning matters

A distiller sends millions of requests to a stronger model and trains a smaller one on the replies. The prize is Claude's reasoning, the thinking it writes out before it answers, because that shows the smaller model how the answer was reached. So Anthropic's defenses go almost entirely at the reasoning.

Its first move was to show users a summary of that reasoning instead of the full text. Anthropic measured what this costs a copier: a pretrained Claude model trained on full transcripts from Claude Opus 4.8 scored 80.4% on SWE-bench Verified, and 71.8% when it only had the summaries.

Distillers answered by asking Claude outright for its full reasoning. One lab tested 12,000 requests, each a different trick. Proxy networks ran hundreds of thousands of fraudulent accounts (one, Anthropic reported in February, ran more than 20,000 at once).

What changed

With Claude Fable 5.1 and Claude Opus 5.5, Anthropic brought in preserved thinking. API accounts created on or after August 31, 2026 can't edit Claude's prior context, which shuts down a trick distillers used: moving protected reasoning into a new conversation so Claude believes they've already seen it.

The second layer is a two-stage classifier, the same kind Anthropic uses to stop Claude helping with bioweapons. Anthropic says it's now roughly as robust as those safeguards. It runs on Claude Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1.

Accounts that keep trying get stricter usage limits, then bans. And since September 24, Anthropic has charged for requests its safeguards block before Claude answers, in areas like distillation where the false positive rate is under 0.1%.

Zhipu and Moonshot

Anthropic says Zhipu tried Claude Fable 5 first. When Claude's cyber safeguards degraded its attacks, it switched to an older Claude model and another lab's model. Anthropic's own researchers found GLM-5.3's safeguards easy to bypass.

The US government's testing backs the first half of that. NIST's CAISI published its assessment of GLM-5.3 on September 17, 2026, and put it about four months behind the US frontier.

On Moonshot, Anthropic points to one forwarded request. It came from a user Anthropic believes was affiliated with China's People's Liberation Army, who wanted CCTV surveillance of a specific person analyzed.

What it costs

Anthropic says it missed a goal it set in February, to make distillation harder without touching legitimate users. Some developers had to update their integrations for preserved thinking. A small share of honest requests get blocked, and now those get charged too.

I'd treat the 90 to 99% as an early reading. Anthropic says it doesn't know how long the gains will last, and that it hasn't yet seen a highly sophisticated, persistent attempt to get around the new defenses.

Anthropic plans to put the same classifier on any future model that would be similarly attractive to distillers.