Anthropic Says New Defenses Cut Claude Distillation Data Harvesting by 90 to 99 Percent

Anthropic says new defenses have cut the amount of data harvested from Claude through distillation attacks by 90 to 99 percent. The figures come from a September 2026 threat intelligence report in which the company details how it tracked, attributed and disrupted illicit attempts to extract the model's capabilities, with a focus on reasoning, coding and tool use.

Five Campaigns, One Very Large Customer

In a distillation attack, a rival collects large volumes of a stronger model's responses and uses those transcripts as training data. Anthropic says it attributed nearly 200 million distillation-related exchanges across five separate campaigns in its latest report. The largest of the five involved more than 151 million exchanges between May and July 2026, and the company linked it to Alibaba's Qwen.

The disclosure is not the first of its kind. In February 2026, Anthropic revealed earlier campaigns involving more than 16 million exchanges, carried out through approximately 24,000 fraudulent accounts.

How the Defenses Work

Anthropic describes a layered approach rather than a single fix. Account bans form one layer, while metadata analysis and behavioral classifiers form others. The company also uses organizational attribution methods to connect activity back to the groups behind it.

Several defenses arrived with product updates. The Fable 5 update introduced strengthened extraction classifiers designed to flag usage patterns that look like systematic harvesting, along with summarization features in Claude. Because summarized output is a condensed version rather than a full step-by-step reasoning trace, harvested transcripts become far less useful as training material. Fable 5.1 then added a feature Anthropic calls preserved thinking, which prevents new API accounts from editing encrypted reasoning context, closing off one route for manipulating the model into exposing or reshaping its reasoning.

A Broader Industry Fight

Anthropic is not alone in this effort. OpenAI released its own September 2026 report outlining techniques to disrupt similar distillation attempts, including a method called encrypted reasoning replay.

There is also a safety argument. Illicit distillation raises questions about whether safeguards built into the original model carry over to the distilled copy. A lab can spend enormous effort training a model to refuse dangerous requests, but a copy trained on harvested outputs may not inherit those guardrails.

Anthropic draws a line between this kind of activity and legitimate research use, noting that distillation as a technique is not inherently sinister. The problem is doing it at scale, through fraudulent accounts, against a provider's terms. The company acknowledges that illicit distillation efforts continue and that its safeguards will need to keep evolving.

Sources: Techmeme · Anthropic Help Center