Anthropic Adds Defenses Against Claude Model Distillation Attacks

Anthropic announced on October 12, 2026 that it had significantly strengthened its defenses against illegal distillation attacks on its Claude AI models. The company said the new security measures reduced the volume of inference data collected by attackers by roughly 90 to 99 percent, according to aitimes.com.

Anthropic built a two-stage classification system based on its Constitutional Classifiers research to detect hidden reasoning output and indirect extraction attempts in real time. The company said the system has a false positive rate under 0.1 percent and is applied to Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1.

API and model changes

Anthropic introduced a 'preserved thinking' feature in Fable 5.1 and Opus 5.5. New API accounts created after August 31, 2026 are restricted from arbitrarily modifying the context of previous conversations, and in Sonnet 5.5, Anthropic limited access so that only the organization that generated a request can view its reasoning records.

From September 24, 2026, Anthropic began charging for requests blocked by certain safety measures, including distillation-related requests. The company said the number of reasoning tokens extracted by attackers fell to between one-tenth and one-hundredth of previous levels after the new defenses were applied.

Anthropic said it gave up significant revenue and paid traffic in the trillions of tokens while blocking distillation attacks, and that some legitimate developers had to modify their API integration methods. The company also accused China's Z.ai of attempting to distill Claude's cybersecurity capabilities while developing GLM-5.3.

In a February report, Anthropic said one network managed more than 20,000 fake accounts simultaneously.