Anthropic Says New Shields Cut AI Distillation by Up to 99%

Anthropic said on Monday that new safeguards designed to stop rivals from copying its Claude models have cut the amount of data harvested in so-called AI distillation attacks by roughly ninety to ninety-nine percent. The company described the figures as early evidence from its own monitoring, and said the change took effect after it restricted access to the models' reasoning and cracked down on the networks probing them.

Distillation, in this context, is not ordinary studying. It means repeatedly questioning a powerful model and training a cheaper rival on the answers, so the copycat gains advanced abilities without paying for the research behind them. Anthropic, OpenAI and Google have all argued the practice lets competitors close the gap faster and at lower cost, and the dispute over AI distillation has sharpened as AI competition between the United States and China intensifies.

How the safeguards work

The centerpiece is a limit on who can see Claude's protected reasoning. According to the company, the volume of reasoning tokens pulled out by would-be distillers is now ten to a hundred times lower than it was before the restrictions. The number measures the stream of intermediate steps a model produces while working through a problem, which trainers prize because it shows how the model thinks.

Anthropic also said it has made it harder to run those probes through proxy networks, the relay services that mask repeated automated queries and make large-scale AI distillation difficult to trace. The company said the blocks have hindered large-scale extraction efforts, cutting off the industrial-scale questioning that makes copying practical.

In an October 12 statement on its defenses against AI distillation, Anthropic said it had banned tens of thousands of accounts linked to distillation campaigns. The announcement is the latest in a busy stretch for the company, which recently entered a partnership with HCLTech on a dedicated agentic AI unit. The company described its detection system as roughly as strong as the safeguards that keep Claude from assisting with bioweapons, with a false positive rate of less than a tenth of a percent.

The announcement fits a pattern of hardening around the company's newest models. With the release of Claude Opus 5.5, Anthropic added a feature called preserved thinking, which stops API users from editing a conversation's earlier context in an attempt to extract the model's reasoning. The company said that protection applies to API accounts created on or after August 31, 2026, and that the model cannot be run with thinking mode switched off.

Why it matters now

The company did not frame the announcement as a routine product update. It said unauthorized distillation raises safety and national security risks, and it singled out one case: Chinese AI startup Z.ai, also known as Zhipu, which Anthropic said attempted to distill capabilities from Claude while developing its GLM-5.3 model. Z.ai did not immediately respond to a request for comment, Reuters reported.

The naming of a specific company marks a sharper public posture. For years, the big AI labs have complained privately about distillation while treating it as a cost of doing business online. Putting a name and a model to the accusation turns an abstract technical complaint into a concrete dispute with a rival.

The stakes reach beyond corporate rivalry. Frontier models trained on distillation inherit capabilities their builders never vetted through the same safety process, and governments are watching how fast those capabilities spread. The United States has tightened controls on advanced chip exports to China precisely to slow the transfer of cutting-edge AI capacity, and Anthropic's warning about national security echoes that logic: a distilled copy can put near-frontier ability in the hands of actors that did not invest in the safeguards.

Public scrutiny of how models behave is sharpening on other fronts too. Recent coverage has examined how conversational AI can steer users toward conspiracy theories, while agent software keeps drawing heavy investment, with startups raising millions to put AI agents to work in businesses from car dealerships to customer service.

Whether the new defenses hold is an open question. Extraction techniques evolve quickly, and the company's own figures are preliminary. For now, Anthropic is betting that restricting reasoning, blocking proxy-driven probes and removing tens of thousands of abusive accounts will make large-scale copying materially harder. The next wave of extraction attempts, reported by Reuters and analyzed in depth at alfw.ai, will test whether that bet pays off.