Anthropic said on Monday (12) that its new defenses against unauthorized copying of artificial intelligence models reduced, by between 10 and 100 times, the volume of reasoning extracted from Claude by agents identified as responsible for distillation attacks. The results were presented in a technical report detailing access restrictions, detection systems and account bans.
Distillation consists of using responses from an advanced model to train another system to reproduce its capabilities. One of the most valuable targets is reasoning records, which reveal intermediate steps used by the model before producing a response.
To make this extraction harder, Anthropic adopted a two-stage classification system, capable of identifying requests that try to retrieve protected reasoning. The protection is active in models such as Claude Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1.
The company also restricted the transfer of reasoning records between models, conversations and accounts. Since August 31, 2026, new API accounts are subject to a protection that prevents editing of certain prior contexts in compatible models.
Accounts involved in recurring extraction attempts face stricter usage limits and possible bans. Anthropic says it has shut down tens of thousands of accounts associated with distillation, often less than two hours after the start of the campaigns.
Reduction of up to 100 times is an internal measurement, and legitimate users can be charged
The disclosed reduction was calculated based on Anthropic's own estimates of the amount of reasoning tokens extracted on its platform. It is not an independent measurement, nor a demonstration that the attacks have been eliminated.
The company acknowledges that it has not yet faced a highly sophisticated and persistent attempt to circumvent the full set of new protections. It also admits it does not know how long the results will be maintained.
The restrictions have consequences for legitimate developers. Although the classifiers have a stated false-positive rate below 0.1%, permitted requests can be incorrectly identified and blocked.
Since September 24, Anthropic has resumed charging for certain blocked requests before Claude even responds, including cases related to distillation in categories where its systems record false positives below 0.1%.
The company also acknowledges that some integrations had to be updated to work with the new restrictions. The measures were implemented at different times, while the October 12 publication compiles the observed results and explains their limitations.
