Anthropic reports that new defenses against industrial-scale distillation have reduced the volume of extracted Claude reasoning tokens by 90 to 99 percent. The attacks systematically copy model capabilities to train smaller rival systems through networks of hundreds of thousands of fake accounts. The disclosure matters because reasoning traces have become a central asset in competition between AI vendors.
How Anthropic describes the distillation campaign
Distillation in this case means mass querying of Claude to collect its internal chain-of-thought steps and then using that material to train separate models. Anthropic puts the reduction in stolen reasoning tokens at 90 to 99 percent after deploying countermeasures. The operation relied on hundreds of thousands of fake accounts, which points to coordinated infrastructure rather than isolated misuse. Tens of thousands of accounts have already been banned under the new enforcement.
The defense rests on three elements: restricted access to internal reasoning steps, a classifier that detects extraction attempts, and automatic banning of flagged accounts. Limiting visibility into chain-of-thought output reduces the material available for training competing models. The classifier is intended to separate large-scale collection patterns from normal use, while automation allows action at the scale of the attack. Anthropic acknowledges that legitimate users are also affected by false detections.
Anthropic publicly names Chinese companies Zhipu and Moonshot as participants in such activity. Zhipu allegedly extracted cyber capabilities from leading US models for its GLM-5.3 model. Moonshot allegedly routed queries secretly through Claude to obtain capabilities indirectly. According to Anthropic, stolen capabilities could reach foreign military and surveillance systems, which raises the issue beyond commercial competition.
What this means for companies using AI models
For business buyers, restricted reasoning output changes how model behavior can be inspected and documented. Teams that relied on detailed intermediate steps for debugging, audit, or process control will receive less visibility. Large organizations can adapt by building logging and evaluation around final outputs and approved interfaces. Smaller firms with fewer testing resources may find it harder to diagnose inconsistent agent behavior.
The enforcement approach also introduces availability and continuity risk for production deployments. A classifier with automatic bans can interrupt work if legitimate high-volume use resembles extraction, such as testing, benchmarking, or parallel agents. Contracts and architecture should account for account-level blocking, appeal procedures, and separation of experimental workloads from customer-facing systems. Vendor statements about accuracy of detection deserve direct questions before scaling usage.
The marker to watch is whether other AI developers adopt comparable protections and publish their own extraction figures. Joint adoption would signal that reasoning traces are being treated as protected intellectual property across the industry. Continued bans, named incidents, or changes to reasoning disclosure would confirm that distillation remains an active constraint on model access.
