Anthropic says new anti-distillation defences cut the Claude reasoning that distillers can extract by roughly 90 to 99 percent, using preserved thinking, a two-stage classifier and charging for blocked requests; names Zhipu's GLM-5.3 as a distilled cyber-capable model
Anthropic published a post on 12 October 2026 describing how it has hardened Claude against distillation attacks, in which organised networks of fraudulent accounts harvest a frontier model's outputs, especially its reasoning transcripts, to train a cheaper copy. Anthropic says the measures have cut the amount of data distillers can harvest by about 90 to 99 percent, and that reasoning tokens extracted on its own platform fell 10 to 100-fold after its classifier went live. The measures: 'preserved thinking' in Claude Fable 5.1 and Opus 5.5, which stops API accounts created on or after 31 August 2026 from editing Claude's prior context; blocking older, weaker models from reading newer models' reasoning, and limiting Sonnet 5.5 reasoning transcripts to the organisation whose request produced them; a two-stage classifier, red-teamed internally and externally, that Anthropic says is about as robust as its biological-weapons safeguards with a false-positive rate under 0.1 percent; and, since 24 September, charging for requests blocked by those safeguards. It has banned tens of thousands of distillation accounts, often within two hours, and says one proxy network ran more than 20,000 fraudulent accounts at once. Anthropic names Zhipu as having distilled US models' cyber capabilities into GLM-5.3, which a US government evaluator called the most cyber-capable open-weights model released so far. Anthropic admits trade-offs: some developers had to update integrations, and benign requests are occasionally blocked and billed. Primary: Anthropic; wire: The Hacker News ThreatsDay (16 Oct).
- Product
- Anthropic Claude API (Fable 5/5.1, Opus 5/5.5, Sonnet 5.5)
- Exploited in Australia?
- unknown
- Patch to
- Developers on new Claude API accounts: check integrations that edit or replay prior assistant context, since preserved thinking now blocks that. Platforms and resellers: watch for account farms and proxy networks reselling model access, and offboard fraudulent accounts quickly.
Primary: Anthropic — Strengthening our defenses against distillation attacks (12 Oct 2026) · Vendor: Claude Platform docs — Preserved thinking · The Hacker News — ThreatsDay bulletin: Anthropic adds distillation defenses (16 Oct 2026)