Anthropic Says New Safeguards Cut Claude Distillation Harvest by 90 to 99 Percent

Every frontier AI lab has the same nightmare, and it is not a rival building a better model from scratch. It is a rival quietly copying yours — asking it millions of carefully shaped questions, harvesting how it reasons, and training a cheaper model on the answers. Anthropic says it has now made that kind of copying dramatically harder.

Reuters reported, via BusinessWorld and other outlets carrying the Reuters story on October 13, that Anthropic said on Monday its new safeguards against so-called distillation attacks have reduced the data harvested from its Claude models by about 90 to 99 percent. According to Reuters, Anthropic said the number of reasoning tokens extracted by distillers is now 10 to 100 times lower than before the measures. The Northern Current, in its own write-up of Anthropic's announcement, reported the same 90 to 99 percent range and added an important caveat straight from the company: the figure is Anthropic's own measurement, not an independent audit.

That distinction is the right way to read this story. This is a company reporting that its defenses are working, in a field where the attacks are covert by design and nobody outside can easily verify the scoreboard. It is still significant — because of the scale Anthropic is claiming, the actor it named, and the lengths it says it has gone to.

What Distillation Is, and Why Reasoning Is the Prize

Distillation itself is a normal, legitimate technique: a smaller model learns from the outputs of a larger one. The problem, as Anthropic defines it and as Reuters reported, is illicit distillation — a covert, industrial-scale effort to reproduce another developer's capabilities without authorization, often through networks of fraudulent or proxy accounts that repeatedly probe a model.

The Northern Current explained why reasoning data sits at the center of the fight: a model's reasoning traces show how it works through a problem, not just the final answer it gives. Harvest enough of that, the argument goes, and a rival can reproduce advanced coding, analysis and agent-style capabilities faster and more cheaply — while leaving behind the safety controls the original lab built around those capabilities. In other words, the copier gets the power without necessarily inheriting the brakes.

That is why Anthropic framed this as more than a trade-secret issue. Reuters reported that Anthropic warned such practices pose safety and national security risks, in a broader context of intensifying competition between the United States and China in advanced AI — a context Reuters noted also involves OpenAI and Google, which have raised similar concerns about distillation.

The Defenses, and the Z.ai Example

According to Reuters, Anthropic said it has made it harder to use proxy networks to repeatedly probe Claude's protected reasoning, blocking extraction attempts and hindering large-scale campaigns. The Northern Current, describing Anthropic's layered system, said the defenses restrict where protected reasoning can be moved, use a two-stage classifier to detect extraction attempts, and impose limits or bans when accounts repeatedly probe for hidden reasoning. It also described a feature Anthropic calls preserved thinking, intended to stop newer API accounts from editing parts of the context that precede protected reasoning — a tactic attackers had used to try to make Claude disclose material it was meant to keep hidden.

Anthropic also put a name in the frame. Reuters reported that Anthropic cited Chinese AI startup Z.ai, also known as Zhipu, as an example of a company that attempted to distill capabilities from Claude while developing its GLM-5.3 model. The Northern Current reported that Anthropic alleged Z.ai attempted to extract cyber capabilities while developing GLM-5.3. Both outlets noted the same response — or lack of one: Reuters said Z.ai did not immediately respond to a request for comment. Previously is reporting Anthropic's allegation as exactly that, an allegation by Anthropic, not an adjudicated finding.

On enforcement, Reuters reported that Anthropic banned tens of thousands of accounts linked to distillation campaigns. The Northern Current added that, according to Anthropic, suspected distillers' extracted reasoning tokens fell by a factor of 10 to more than 100 after the changes, and that linked accounts have sometimes been banned within two hours of a campaign starting.

As Robust as Bioweapon Safeguards — With a Caveat

The comparison Anthropic chose tells you how seriously it wants this taken. Reuters reported that Anthropic described its system as roughly as robust as those that prevent Claude from helping build bioweapons, and said it has a false positive rate of less than 0.1 percent. That second number matters to ordinary developers: a defense that blocks copiers but constantly blocks legitimate customers would be a cure worse than the disease.

The Northern Current reported the trade-offs Anthropic acknowledged: some legitimate developers have had to update integrations, a small number of benign requests may be blocked, and users are now charged for certain requests stopped by high-confidence safeguards before Claude responds. Anthropic also cautioned, in that account, that it has not yet faced a highly sophisticated, persistent attempt to defeat the new controls, and that attackers may adapt. That is an unusually honest footnote for a victory announcement, and it is the part of this story most worth remembering in six months.

Why It Matters Beyond One Company

Strip away the corporate framing and the underlying question is structural. Frontier models cost enormous sums to train, and their most valuable asset — how they reason — can, in principle, be siphoned off through the very APIs the labs sell access to. If extraction is cheap and hard to detect, the incentive to build original frontier models weakens and the incentive to copy them grows. If extraction defenses work, the economics tilt back toward building. OpenAI's separate disclosure in September of a coordinated distillation campaign, noted by The Northern Current, underlines that this is an industry-wide contest, not a single company's feud.

For readers who simply use Claude or its rivals every day, the practical effects will be quieter: tighter account checks, the occasional blocked request, integration changes if you build on the API. Our newsroom covers this beat alongside the rest of tech in our daily coverage, and the business stakes are the same ones running through our reporting on the AI race across the Previously front page.

Anthropic has claimed a big win, with numbers — 90 to 99 percent less harvested data, extraction down 10 to 100 times, tens of thousands of bans, false positives under 0.1 percent — that are now on the record via Reuters and Anthropic's own post. The honest summary is the one the company itself supplied: the defenses look strong so far, they have not yet met their most determined test, and the other side gets a vote. In this particular arms race, they always do.

More technology coverage is in the Previously newsroom and on our homepage; entertainment and culture are on the Browse front, and live programming is at Live.