Anthropic Distillation Safeguards Cut Claude Extraction 90%

Anthropic announced on Monday, October 12, that its new distillation defenses have cut the amount of data harvested from its Claude models by 90% to 99%. The Anthropic distillation safeguards target the systematic probing campaigns that try to copy frontier AI capabilities by extracting Claude's step-by-step reasoning, a practice the company says carries growing safety and national security risks. The announcement named Chinese AI startup Z.ai, also known as Zhipu, as one company that attempted to distill Claude's capabilities while developing its GLM-5.3 model, according to Reuters.

The Anthropic distillation safeguards have driven the number of reasoning tokens extracted by distillers to 10 to 100 times below previous levels, and that it has banned tens of thousands of accounts tied to distillation campaigns. Model distillation has emerged as a key concern for leading AI labs amid intensifying US-China competition, with firms including Anthropic, OpenAI and Google arguing that the practice lets rivals reproduce advanced capabilities more quickly and at lower cost, reported by Traders Union.

How the Anthropic distillation safeguards work

The Anthropic distillation safeguards, which the company laid out in a research post on Monday and rolled out over recent months, concentrate on Claude's reasoning — the intermediate thinking the model produces before answering, according to the company's account of the findings. Distillers prize reasoning traces because they reveal how a frontier model solves problems, making them the most valuable material for training cheaper copycat models.

With Claude Fable 5.1 and Claude Opus 5.5, new API accounts created on or after August 31 can no longer edit Claude's prior context, a feature Anthropic calls preserved thinking, according to reporting on the research post. Closing that editing path removes one of the main levers distillers used to steer Claude into exposing more of its internal reasoning than intended, and it is a centerpiece of the Anthropic distillation safeguards.

A new two-stage classifier now screens for extraction attempts, blocking them with a false positive rate below 0.1%, according to Yellow's coverage. Anthropic also made it harder to use proxy networks to repeatedly probe Claude's protected reasoning, and says the account bans it issued — tens of thousands of them, often within two hours of detection — broke up large-scale distillation campaigns before they could accumulate enough data. The company described the system as roughly as robust as the protections that prevent Claude from assisting with bioweapons, signaling how seriously it ranks distillation among its threat models.

Why agent builders should pay attention

For teams building AI agents, distillation is more than a model-lab dispute — it shapes the economics of the whole ecosystem. Agents that run cheaply on distilled clone models can undercut services built on licensed frontier APIs, but the enforcement wave shows that shortcut carries real operational risk: accounts vanish, sometimes within hours, and the training data pipeline they feed can collapse overnight. Builders betting a product roadmap on extracted capabilities are exposed to a cat-and-mouse game where the frontier lab holds the cards — and the Anthropic distillation safeguards raise the stakes of that game.

The legitimate path forward is the licensed one. Enterprise deployments increasingly run agents directly on frontier models through official APIs, with governance and audit trails built in — a pattern visible in recent enterprise rollouts such as the DXC partnership using LangChain to run AI agents in mission-critical IT. As distillation defenses tighten, the cost advantage of copycat models shrinks while the compliance and continuity advantages of licensed access grow.

There is also a security dimension specific to agents. Runtime-protection startups are already selling tooling that watches what agents do while they act inside business systems; the Anthropic distillation safeguards add a model-layer counterpart, protecting the reasoning that makes agents capable in the first place. For agent operators, the message is consistent from both layers: the era of grabbing capabilities for free is closing. New frontier models such as Meta's Muse Wonder models, aimed squarely at agent use cases, will likely face the same extraction pressure.

How long will the gains hold?

Anthropic itself struck a cautious note, saying early evidence supports the 90% to 99% reduction but that it does not know how long the gains will last, reported by Reuters. Distillation is an adversarial game, and attackers adapt — the same proxy networks and probing strategies that were blocked this year tend to reappear in new forms.

Z.ai did not immediately respond to requests for comment on the allegation that it distilled Claude while building GLM-5.3. Meanwhile the broader policy fight continues: labs are pressing for stronger norms against unauthorized distillation even as they race to ship the reasoning capabilities that make their models worth copying. Taken together, the Anthropic distillation safeguards are the most aggressive public defense to date — and the opening move in what is likely to be a long campaign.