TL;DR
Anthropic said on Monday 12 October that new safeguards have shrunk the volume of reasoning data distillers extract from Claude by somewhere between 90% and 99%. The post names Zhipu as having distilled cyber capability from leading US models while building GLM-5.3, and says the defences came at a cost: turned-away revenue, integration changes for some developers, and charges for blocked requests. It is the defensive half of a story we have followed since Anthropic’s September threat report.
What distillers are after
Distillation, as Anthropic describes it, is an industrial-scale effort to pull millions of answers out of a frontier model and train a cheaper one to imitate them, usually through networks of fraudulent accounts. The prize is the reasoning transcript, the working Claude writes before it answers, because it teaches a student model how an answer was reached rather than just what it was.
Early countermeasures were simple. Summarising the reasoning before showing it to users made transcripts less useful: a model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, against 71.8% with summaries only. Attackers responded by trying to coax the full reasoning out, with one lab testing 12,000 differently worded requests, and by building proxy networks with hundreds of thousands of accounts, some using stolen payment details.
The three new layers
The current defence works in three ways. Preserved thinking, which arrived alongside Claude Fable 5.1 and Opus 5.5, stops API accounts opened on or after 31 August from altering the model’s earlier context, which blocks the trick of moving reasoning blocks between conversations, models and accounts. A two-stage classifier, built on the same approach as Anthropic’s constitutional classifiers, now screens requests on its most capable models with a false positive rate it puts below 0.1%. And persistent offenders face tighter limits, bans, and, since 24 September, charges for requests the safeguards block.
Anthropic says distillers now obtain between a tenth and a hundredth of the reasoning tokens they got before the classifier, and that it has banned accounts in the tens of thousands, often within two hours of a campaign starting. It also concedes it has not yet faced a sophisticated, persistent attempt to defeat the new system.
Looking forward
The post is partly an argument aimed at rivals and cloud platforms. Anthropic says its work is undermined if attackers can simply switch to another lab’s model with weaker protections, which is what it says Zhipu did when Claude Fable 5’s cyber protections blunted its attacks. We reported last month that GLM-5.3 builds working exploits and its safeguards fail under simple attacks, and that OpenAI disrupted a campaign linked to Moonshot that targeted its own hidden reasoning. For UK developers, the cost side is concrete: blocked requests are now billed, and integrations that edited model context have had to change. In our view, the trade-off is defensible, but it shifts friction onto paying customers, and Anthropic’s own caveat that distillation remains “a cat-and-mouse game” suggests more such changes will follow.