Anthropic published defenses on October 12, 2026, local time, against distillation attacks that copy Claude’s capabilities without authorization. In the company’s initial observations, attackers collected about 90–99% less data. Anthropic assessed the effect using the estimated number of reasoning tokens extracted from its platform.

Model distillation uses the outputs of a high-performing AI model to teach another model how to behave, and can support development of smaller, lower-cost models. Anthropic says its concern is not distillation itself, but large-scale, covert efforts to extract capabilities without the developer’s permission and replicate them in another model. The company disclosed a large-scale distillation attack in February and reported methods for eliciting hidden reasoning processes in a September threat intelligence report.

One defense, “preserved thinking,” checks whether the system prompt, tool settings, or messages preceding reasoning have changed when past reasoning data is reused in a subsequent request. According to Anthropic’s documentation, this check is applied by default to eligible models for API accounts created after August 31, 2026. It is intended to prevent attempts to elicit protected reasoning by altering the context.

Anthropic also uses a two-stage classifier to assess requests and detect and block attempts to extract reasoning. It may restrict usage or suspend accounts of users who repeatedly try. The company says it does not yet know how long the defenses will remain effective. Some developers may need to modify their API integrations, and the classifier can mistakenly block harmless requests; Anthropic puts the false-positive rate below 0.1%.

Since September 24, Anthropic has resumed charging for requests blocked before a response in certain areas, including distillation, where the false-positive rate is below 0.1%. The reported effectiveness figures come from initial observations, and the company has not stated how long the defenses will last. The summary also notes possible effects on legitimate use, including false positives and required API integration changes. It describes the measured data as estimated extraction tokens from Anthropic’s own platform.

Anthropic published defenses on October 12, 2026, local time, against distillation attacks that copy Claude’s capabilities without authorization. In the company’s initial observations, attackers collected about 90–99% less data. Anthropic assessed the effect using the estimated number of reasoning tokens extracted from its platform.

Model distillation uses the outputs of a high-performing AI model to teach another model how to behave, and can support development of smaller, lower-cost models. Anthropic says its concern is not distillation itself, but large-scale, covert efforts to extract capabilities without the developer’s permission and replicate them in another model. The company disclosed a large-scale distillation attack in February and reported methods for eliciting hidden reasoning processes in a September threat intelligence report.

One defense, “preserved thinking,” checks whether the system prompt, tool settings, or messages preceding reasoning have changed when past reasoning data is reused in a subsequent request. According to Anthropic’s documentation, this check is applied by default to eligible models for API accounts created after August 31, 2026. It is intended to prevent attempts to elicit protected reasoning by altering the context.

Anthropic also uses a two-stage classifier to assess requests and detect and block attempts to extract reasoning. It may restrict usage or suspend accounts of users who repeatedly try. The company says it does not yet know how long the defenses will remain effective. Some developers may need to modify their API integrations, and the classifier can mistakenly block harmless requests; Anthropic puts the false-positive rate below 0.1%.

Since September 24, Anthropic has resumed charging for requests blocked before a response in certain areas, including distillation, where the false-positive rate is below 0.1%. The reported effectiveness figures come from initial observations, and the company has not stated how long the defenses will last. The summary also notes possible effects on legitimate use, including false positives and required API integration changes. It describes the measured data as estimated extraction tokens from Anthropic’s own platform.