In a research post dated October 12, 2026, Anthropic described how it has expanded its defenses against so-called distillation attacks. According to early evidence, the measures have reduced the data harvested by distillers by around 90 to 99 percent. The figure comes from Anthropic itself; according to the available sources, no independent verification exists.
What distillation means
Anthropic describes distillation as covert, industrial-scale campaigns that extract one model's capabilities and replicate them in another, without the original developers' authorization. Such attacks are often run through networks of fraudulent accounts. According to Anthropic, they let companies mimic frontier capabilities in a fraction of the development time and cost. The company had already reported in September that the method was being used extensively to help overseas AI labs keep pace with US companies.
Why the company is concerned
Anthropic cites two reasons. First, distillation can produce models that approach the capability frontier but are released without proportionally robust safeguards. Anthropic points to biology and cybersecurity as areas of possible harm. As an example, it says Zhipu distilled the cyber capabilities of leading US models during the development of GLM-5.3. Second, Anthropic sees a national security risk, because companies distilling US models may, in its account, integrate the gained capabilities into foreign military, intelligence and surveillance systems.
The approach
According to Anthropic, the defense focuses mainly on making the model's reasoning harder to access, since distillers consider detailed reasoning transcripts especially valuable. Anthropic describes three approaches: controlling where reasoning can travel; blocking and patching extraction attempts with a two-stage classifier system, which the company says has a false positive rate below 0.1 percent; and making repeated attempts difficult through stricter usage limits and account bans.
Background
Anthropic had previously used simpler measures, such as summarizing reasoning before it is shown. In its own evaluation on SWE-bench Verified, a model trained on full transcripts scored 80.4 percent, while one trained on summarized transcripts scored 71.8 percent. Attackers then shifted, according to Anthropic, to active extraction attempts that at times involved networks controlling hundreds of thousands of fraudulent accounts.
Assessment
For companies using AI models via APIs, the development may matter because Anthropic acknowledges that some legitimate users had to update their integrations and that the company gave up revenue deliberately. It remains open how well the measures will hold against attackers willing to invest more effort; Anthropic itself expects that workarounds will be found. Whether the cited percentages can be independently confirmed is currently not established.
Sources
Editorially owned by Ideal Syka. Sources and method: Newsroom & method. Tips and corrections: ai@i6eal.de.
