Anthropic says new defenses cut distillation data harvested from Claude by 90 to 99 percent

Anthropic says it has made serious headway against people trying to copy Claude’s homework. According to the company, new defenses have cut the amount of data harvested through distillation attacks by 90 to 99 percent.

The figures come from a September 2026 threat intelligence report. In it, Anthropic details how it has tracked, attributed and disrupted illicit attempts to extract Claude’s capabilities. The focus falls mainly on reasoning, coding and tool use.

Nearly 200 million exchanges, one very large customer

Technically, a rival collects large volumes of a stronger model’s responses and uses those transcripts as training data.

Anthropic says it attributed nearly 200 million distillation-related exchanges across five separate campaigns in its latest report.

The biggest of the five stands out. Anthropic linked it to Alibaba’s Qwen, and it involved more than 151 million exchanges between May and July 2026.

This is not the first time Anthropic has gone public on the issue. Back in February 2026, the company disclosed earlier campaigns that involved more than 16 million exchanges. Those operations relied on approximately 24,000 fraudulent accounts.

How the defenses actually work

Anthropic describes a layered approach rather than one silver bullet. Account bans sit at one level. Metadata analysis and behavioral classifiers sit at others. On top of that, the company uses organizational attribution methods to connect activity back to the groups behind it.

Several of the defenses arrived with product updates. The Fable 5 update brought strengthened extraction classifiers, which are designed to flag usage patterns that look like systematic harvesting. It also introduced summarization features in Claude.

The summarization piece limits the usefulness of harvested material. If what comes out of the model is a condensed version rather than a full, step-by-step reasoning trace, the transcript becomes far less useful as training material.

Fable 5.1 then added something Anthropic calls “preserved thinking.” This feature prevents new API accounts from editing encrypted reasoning context.

Reasoning traces are some of the most valuable material a distiller can get. If fresh accounts cannot tamper with the encrypted reasoning context, one route for manipulating the model into exposing or reshaping that reasoning gets closed off.

Anthropic is not alone in this fight

OpenAI has been working on the same problem. It released its own September 2026 report outlining techniques to disrupt similar distillation efforts, including a method called encrypted reasoning replay.

There is also a safety argument embedded in all this. Illicit distillation raises questions about whether the safeguards built into the original model carry over to the distilled copy. A lab can spend enormous effort training a model to refuse dangerous requests. A copy trained on harvested outputs may not inherit those guardrails.

Anthropic draws a line between this kind of activity and legitimate research use. The distinction matters because distillation as a technique is not inherently sinister. The problem is doing it at scale, through fraudulent accounts, against a provider’s terms.

Anthropic itself acknowledges that illicit distillation efforts continue and that its safeguards will need to keep evolving.