Anthropic Says Distillation Harvesting Fell 90–99%—Proof Is Internal

On October 12, 2026, Anthropic estimated that new Claude safeguards had reduced reasoning data harvested by suspected distillers by roughly 90–99% and led to tens of thousands of account bans, according to a Reuters report. The reduction is an early estimate from activity Anthropic identified on its own platform; no independent reproduction of that measurement has been disclosed.

The defenses make Claude’s hidden reasoning harder to collect, flag requests that try to expose it and restrict accounts that keep probing. They also affect legitimate use: some developers have had to change integrations, benign requests can be blocked, and some blocked requests are billable.

How the extraction campaign changed

Distillation trains a model on another model’s outputs so it can reproduce some of the original’s behavior. Full reasoning transcripts are especially attractive training material because they contain more of the path to an answer than the final response alone. Anthropic initially summarized Claude’s reasoning before presenting it to users, reducing what an operator could collect through ordinary requests.

In its October 12 research update, Anthropic describes a lab testing 12,000 distinct extraction requests, reports an internal SWE-bench Verified result of 80.4% for a pretrained Claude model trained on full Claude Opus 4.8 transcripts versus 71.8% with summarized transcripts, and cautions, “We don’t yet know how long these gains will last.” The benchmark compares training material, rather than measuring how much data the newer safeguards stopped attackers from collecting.

Summaries changed the incentive for attackers. Instead of simply gathering the reasoning made available in normal conversations, they tried prompts designed to make Claude disclose reasoning it had withheld. Protected reasoning was also moved between conversations or models to test whether a weaker boundary would expose it. Networks of fraudulent accounts allowed repeated attempts even after individual accounts were restricted.

Where the newer defenses intervene

Preserved thinking limits changes to Claude’s prior context for affected new API accounts. That makes it harder to transplant a protected reasoning segment into another conversation and persuade the model to reveal it. Restrictions on reading newer models’ reasoning through older models, along with organization-level access to certain transcripts, close related routes for moving that material.

A classifier screens for requests seeking hidden reasoning, while internal and external red teams probe for ways around it. The defenses can be updated when a new prompt technique appears. Requests to translate earlier reasoning into another language or place it beside an answer illustrate why filtering only direct demands to print hidden reasoning would leave gaps.

Access controls address persistence as well as prompt wording. Accounts repeatedly associated with extraction can face tighter usage limits or bans, raising the effort required to keep a campaign running through a proxy network. Billing for certain requests stopped before Claude responds adds a cost to repeated probing, but also makes an incorrect block consequential for an authorized customer.

What the reduction measures

The yardstick is estimated Claude reasoning tokens extracted by suspected distillers on Anthropic’s platform before and after the classifier was introduced. It captures activity the company can identify within its own service and compares observed extraction across that change. It is not a direct measurement of whether another developer can reproduce Claude’s capabilities using final answers, third-party platforms or other models.

The estimate also depends on which traffic is identified as distillation. A decline in observed reasoning tokens cannot establish, by itself, how a rival model’s performance has changed. A sophisticated, sustained effort against the newer controls has not yet been described in the published account, so the durability of the reduction under that pressure remains open.

That boundary matters because each defense has changed attacker behavior. Summarized reasoning made passive collection less useful; extraction prompts then sought the full traces; the newer controls target those prompts and the accounts carrying them. The reported decline describes the latest observed stage of that cycle, rather than a permanent limit on what attackers could obtain.

The costs for Claude customers

An eSecurity Planet account notes that preserved thinking applies to API accounts created on or after August 31, 2026, and cites Anthropic’s claimed classifier false-positive rate of less than 0.1%. Developers whose integrations depend on changing prior context may need to adapt them. Even an uncommon false positive can interrupt a legitimate request, and the reported rate remains the company’s figure.

Charging for requests blocked before Claude answers increases the expense of repeated extraction attempts. It also means an authorized customer may pay for a request mistakenly stopped by the safeguard. Account restrictions present a similar trade-off: fast enforcement can disrupt a campaign, while an incorrect decision can interrupt a customer’s access.

The measures carry a commercial cost for Anthropic as well: rejecting suspected distillation traffic means turning away requests that could otherwise generate revenue. For customers, the consequential test is whether the observed reduction persists as extraction methods change without adding further friction to authorized Claude use.

Also read:

• HubSpot Cuts 660 Jobs—but Says AI Did Not Directly Replace Them
• Zoom vs Teams: External Guests or Internal Context Decides the Winner
• Spotify Is Selling Its Internal Developer Stack—Four Tools Now Share One Home