Anthropic said on October 12, 2026 that it has built three new technical defenses that cut the amount of data rival developers can harvest from Claude through “distillation attacks” by roughly 90% to 99%, according to a research post published on Anthropic’s website. The announcement, picked up by outlets including The Economic Times, IBTimes Singapore and other outlets on October 13, 2026, lands at a moment when the question of who gets to learn from a frontier AI model, and how, has turned into one of the most contested fights in the industry.
Distillation, the practice of training a smaller or competing model on the outputs of a stronger one, has gone from an obscure machine-learning technique to a geopolitical flashpoint since early 2025. Anthropic’s new defenses, which protect Claude Fable 5.1, Claude Opus 5.5 and Claude Sonnet 5.5, represent the company’s most detailed public accounting yet of how it is trying to keep rivals, including Chinese labs such as Zhipu AI, from cheaply copying the reasoning that took billions of dollars and years of research to build.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Anthropic Actually Announced on October 12
Anthropic’s research post, titled “Strengthening our defenses against distillation attacks,” says the company has deployed three separate mechanisms that work together to disrupt attempts to extract Claude’s internal reasoning. In the company’s own words, “early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99%,” a figure the company frames as internal early evidence rather than an independently audited benchmark. BusinessLine reported that the reduction applies specifically to the volume of reasoning data that distillers are able to pull out of Claude’s responses, not to overall API traffic.
Put another way, Anthropic says the number of reasoning tokens a distiller can extract from Claude is now 10 to 100 times lower than it was before the new safeguards went live. That framing matters because distillation economics depend on volume: a would-be competitor needs a large corpus of a frontier model’s chain-of-thought to train a smaller model that mimics its reasoning style. Choke off the volume, and the cost of building a credible copycat model rises sharply, even if the attacker never gets locked out entirely.
Inside the Three New Distillation Defenses
Anthropic’s post describes the defenses as disrupting distillation attacks “in three separate ways,” according to the company’s own research page. The first and most structurally significant is what Anthropic calls preserved thinking. Introduced alongside Claude Fable 5.1 and Claude Opus 5.5, it stops API accounts created on or after August 31, 2026 from editing Claude’s prior reasoning context. That closes off a workaround that distillation operators had used: feeding a model’s own chain-of-thought back into follow-up prompts to reconstruct a cleaner, more complete training signal than a single response would provide.
The second defense is a two-stage classifier built on the same approach described in Anthropic’s earlier work on constitutional classifiers. Reports on the announcement put the system’s false-positive rate below 0.1%, meaning legitimate developers querying Claude for ordinary coding or research tasks are rarely flagged by mistake. The classifier is designed to catch reasoning-extraction attempts in real time, as requests come in, rather than after the fact.
The third defense is less a piece of code than a policy lever: account- and usage-level enforcement. Accounts that repeatedly attempt to extract Claude’s reasoning face tighter rate limits or outright bans, and Anthropic has reportedly been charging for requests that its systems block since September 24, 2026. Treating a blocked distillation attempt as a billable event, rather than a free no-op, raises the direct cost of running the kind of high-volume probing that distillation depends on.
The Three Defenses at a Glance
| Defense | What It Does | Models Covered | Reported Detail |
|---|---|---|---|
| Preserved thinking | Blocks newer API accounts from editing or re-feeding Claude’s prior reasoning context | Claude Fable 5.1, Claude Opus 5.5 | Applies to accounts created on or after August 31, 2026 |
| Two-stage classifier | Detects reasoning-extraction patterns in real time, built on Anthropic’s constitutional classifiers approach | Anthropic’s most capable models, including Claude Sonnet 5.5 | False-positive rate reported below 0.1% |
| Account and usage enforcement | Imposes stricter rate limits, bans repeat offenders, and bills for blocked requests | All API accounts subject to Anthropic’s distillation monitoring | Billing for blocked requests reportedly began September 24, 2026 |
Which Claude Models Are Actually Protected
Anthropic’s reporting names three specific models as covered by the new architecture: Claude Fable 5.1, Claude Opus 5.5, and Claude Sonnet 5.5. The company describes the broader classifier-based protections as extending to its “most capable models,” without publishing a complete list, which leaves some ambiguity about whether older or smaller Claude variants get the same treatment. That gap is notable given that Anthropic’s first public anti-distillation mechanisms arrived with the Fable 5.1 and Mythos 5.1 launch back on September 1, 2026, meaning October’s announcement is best read as an escalation of an existing program rather than a first-time response to a surprise attack.
Transcript restriction is the other piece worth separating out. With Claude Sonnet 5.5, reasoning transcripts generated for one organization’s request are only accessible to that same organization, which closes a theoretical path where a shared or resold access arrangement might otherwise let one customer see another’s extracted reasoning chains.
Why the 90% to 99% Figure Deserves Scrutiny
Anthropic’s own framing, “early evidence,” is doing a lot of work in that sentence. None of the coverage of the announcement, including reporting from Enterprise AI and IBTimes Singapore, describes a reproducible benchmark, a disclosed sample size, a defined baseline measurement period, or an independent third-party audit behind the 90% to 99% range. That does not make the number false. It means the figure should be read as a company’s self-reported, early-stage estimate of its own defense’s effectiveness, the same category of claim companies routinely make about new security features before outside researchers get a chance to stress-test them.
There is also a wide range inside that headline figure. A 90% reduction and a 99% reduction describe very different outcomes: the former still leaves one in ten reasoning tokens exposed, while the latter leaves roughly one in a hundred. Anthropic has not said which end of that range applies to which model, which attack pattern, or which time window, so treat the 90-99% claim as a directional signal of a real improvement rather than a precise, model-by-model guarantee.
Why Distillation Became an Existential Threat to Frontier Labs
The economics are straightforward. Training a frontier model from scratch means paying for massive pretraining compute, failed runs, post-training, safety evaluation, and the salaries of the researchers who design all of it, costs public reporting has put anywhere from the hundreds of millions of dollars into the billions for the largest systems. Distillation skips almost all of that. A competitor only has to pay for API access to generate a large volume of a frontier model’s outputs, then use those outputs to fine-tune a far smaller, far cheaper model that mimics much of the original’s behavior. Just Security has described this dynamic as one of the central reasons US policymakers started treating distillation as a national-security issue rather than a routine competitive dispute.
That is also why the three Anthropic defenses target reasoning specifically rather than output text broadly. Chain-of-thought traces, the step-by-step reasoning a model produces en route to an answer, are considered the most valuable thing to steal, because they let a smaller model learn how a frontier model thinks rather than just what it says. Lock down access to that reasoning, and you make the cheap path to a competitive model considerably more expensive.
The DeepSeek Precedent That Set the Stage
Anthropic’s October announcement did not emerge from nowhere. The modern distillation fight traces back to January 2025, when DeepSeek released its R1 reasoning model along with a set of smaller models the company openly described as distilled from R1 itself. Days later, OpenAI said it had seen evidence that accounts using its API were harvesting outputs to train a competing model, reporting at the time widely identified the suspected target as DeepSeek. White House AI adviser David Sacks told Fox News, in comments reported by Fortune, that there was “substantial evidence” DeepSeek had used distillation to build its models.
It is worth being precise about what was and was not established. DeepSeek’s own technical paper documented distilling its own R1 model into smaller open-source variants, a different and openly disclosed act from the separate allegation that DeepSeek may have distilled a closed Western model. OpenAI’s January 2025 statement described suspicious account activity and request patterns consistent with distillation, but no public record has produced the underlying logs or training data that would independently confirm a Western model’s outputs ended up inside DeepSeek-R1’s training corpus. The controversy escalated anyway, and by September 2026 it had become a state-to-state dispute, with China’s Ministry of Commerce formally rejecting a joint US advisory from the NSA, FBI and CISA that accused Chinese developers of running industrial-scale distillation operations.
Zhipu’s GLM-5.3 and the China Angle
Coverage of Anthropic’s October 12 research post, including a writeup from Resultsense, noted that Anthropic’s materials name Zhipu AI’s GLM-5.3 in the context of the broader competitive landscape its new defenses are meant to address. That detail lands against a backdrop where GLM-5.3 has already shown it can go toe-to-toe with Western models on specific benchmarks: tech-insider.org previously reported that GLM-5.3 edged out Anthropic’s models on a cybersecurity benchmark, scoring 84.5%. None of the available reporting on the October 12 announcement, however, establishes a documented, verified case that GLM-5.3 itself was built through distillation of a Western frontier model, and that distinction matters. Being named in a competitive context is not the same as being named as a confirmed source of theft.
The broader pattern is still clear. Chinese AI labs have closed benchmark gaps with US frontier models at a pace that has unsettled Washington, and distillation, whether proven or merely suspected in any single case, has become the default explanation reached for when that gap narrows faster than compute and headcount alone would predict.
How Rivals’ Terms of Service Compare
Anthropic is not alone in trying to legally and technically wall off its outputs. OpenAI, Google and Anthropic all grant customers rights to the outputs their own API calls generate, but each company’s commercial terms separately prohibit using those outputs to train or develop a model that competes with the provider’s own products. What differs is enforcement. Anthropic’s October 12 announcement is the most detailed public technical account any of the three has given of how it actually detects and blocks violations in practice, rather than simply stating the prohibition exists on paper.
| Provider | Contractual Restriction | Public Technical Enforcement Disclosed |
|---|---|---|
| Anthropic | Commercial terms prohibit using outputs to build a competing model or product | Three named defenses: preserved thinking, two-stage classifier, account/usage enforcement |
| OpenAI | Services agreement prohibits using output to develop models that compete with its products | Reported detection of suspicious account activity in the 2025 DeepSeek episode; no equivalent named technical architecture disclosed |
| Gemini API terms prohibit using output to develop competing models | No equivalent named technical architecture publicly disclosed |
Anthropic’s Escalating Pattern of Anti-Theft Measures
October’s announcement fits a pattern that has been building at Anthropic for most of 2026. The company’s broader cybersecurity posture has included aggressive pricing moves on smaller models like Claude Haiku 5.5 aimed at making Anthropic’s own stack more attractive than a distilled alternative, alongside the September 1 anti-distillation mechanisms shipped with Fable 5.1 and Mythos 5.1. The through-line across all of it is a company treating model theft not as a one-time patch but as an ongoing arms race that needs a new layer of defense every few weeks.
That framing also explains why Anthropic chose to publish detailed research rather than a brief press statement. A technical breakdown aimed at other security researchers and competing labs signals that Anthropic wants the industry, not just its own customers, to treat distillation defense as a shared discipline, similar to how phishing or fraud detection techniques get published and iterated on across the security industry rather than kept entirely proprietary.
Market and Competitive Impact
The most direct effect of Anthropic’s move is on the economics facing anyone trying to build a cheaper Claude competitor through API harvesting rather than original training. If the 90% to 99% reduction holds up under outside scrutiny, the volume of usable reasoning data available to a distiller for the same dollar spent on Claude access drops sharply, which pushes the effective cost of a distilled competitor closer to the cost of training from scratch, undermining the entire economic case for distillation in the first place.
There is a second-order effect worth watching too. If Anthropic’s architecture proves durable, expect OpenAI and Google to publish their own named technical defenses rather than relying on contractual language alone, since none of the three companies wants to be seen as the softest target in an industry where reasoning quality is increasingly the actual product being sold. Competitive pressure, not altruism, is the more likely driver of any copycat security disclosures from rivals in the months ahead.
What It Means for Developers Building on Claude
For the overwhelming majority of Anthropic’s API customers, none of this changes daily workflows. The classifier’s reported sub-0.1% false-positive rate suggests ordinary coding assistants, research tools and customer-support bots built on Claude Opus 5.5 or Claude Sonnet 5.5 should see no difference in latency or output quality. The groups most likely to feel friction are accounts created after August 31, 2026 that rely on re-feeding Claude’s own prior reasoning back into follow-up prompts, a pattern more common among research teams building chain-of-thought evaluation pipelines than among typical production applications, but one that preserved thinking now blocks regardless of the user’s actual intent.
Enterprises with compliance obligations around AI-generated reasoning may also want to revisit how they handle Claude Sonnet 5.5 transcripts internally, since Anthropic’s restriction now ties transcript access strictly to the organization that generated the request, which can affect workflows where reasoning logs were previously shared across business units or with external auditors.
Predictions: Where AI Model Security Goes Next
- Expect OpenAI and Google to publish their own named anti-distillation architectures within the next two to three quarters, following Anthropic’s lead in moving from contractual prohibition to disclosed technical enforcement.
- Independent researchers will likely attempt to replicate or challenge Anthropic’s 90% to 99% figure, and the real number that survives scrutiny could land anywhere inside that range or narrower than either end.
- US-China friction over distillation allegations will keep escalating in parallel with these technical defenses, since better detection tools give Washington more concrete evidence to point to in future advisories.
- Smaller and open-source model developers will face rising pressure to disclose their own training data provenance, as frontier labs use distillation-defense disclosures as a competitive differentiator against labs seen as more vulnerable to theft.
- Pricing on frontier reasoning models may continue trending toward discounted smaller tiers, similar to the Claude Haiku 5.5 price cut, as labs try to make legitimate access cheaper than the economics of distillation.
The Bigger Picture
Anthropic’s October 12 research post will not end the distillation debate, and the company’s own “early evidence” framing suggests even Anthropic is not claiming victory yet. What the announcement does accomplish is moving the conversation from vague contractual bans toward a concrete, if self-reported, technical architecture that other labs and outside researchers can now evaluate, critique and eventually try to replicate or beat. In an industry where the gap between a frontier model and its cheapest copy is one of the few genuinely scarce competitive advantages left, that shift from policy to engineering is likely to matter more than the headline percentage itself.
Frequently Asked Questions
What is AI model distillation?
Distillation is a technique where a smaller or competing AI model is trained on the outputs, especially the step-by-step reasoning, of a larger and more capable model, letting the smaller model mimic much of the original’s behavior at a fraction of the training cost.
What exactly did Anthropic announce on October 12, 2026?
Anthropic published research describing three new defenses against distillation attacks: preserved thinking, a two-stage classifier for detecting reasoning extraction, and account- and usage-level enforcement including bans and charges for blocked requests.
Which Claude models are protected by the new defenses?
Anthropic names Claude Fable 5.1, Claude Opus 5.5 and Claude Sonnet 5.5 specifically, and describes broader classifier protections as covering its most capable models without publishing a complete list.
How much data theft reduction is Anthropic claiming?
Anthropic says the defenses have reduced the amount of reasoning data harvested by distillers by roughly 90% to 99%, which it also describes as reasoning tokens extracted dropping 10 to 100 times compared to before.
Is the 90% to 99% figure independently verified?
No. Anthropic describes it as early evidence from its own internal measurement. No public reporting as of October 13, 2026 identifies an independent benchmark, disclosed sample size, or third-party audit behind the figure.
What happened in the 2025 DeepSeek distillation controversy?
In January 2025, DeepSeek released R1 and openly disclosed distilling smaller models from it. Separately, OpenAI said it saw evidence that its own outputs were being harvested by suspected DeepSeek-linked accounts. White House adviser David Sacks said there was “substantial evidence” of distillation, though no public record has independently confirmed that a Western model’s outputs were used in DeepSeek-R1’s actual training corpus.
Do OpenAI and Google have similar protections?
Both companies’ terms of service prohibit using outputs to train competing models, similar to Anthropic. Neither has publicly disclosed a named technical architecture as detailed as Anthropic’s October 12 announcement.
What does this mean for developers building on Claude’s API?
Most legitimate production use cases should see no change. Developers who re-feed Claude’s prior reasoning into follow-up prompts on accounts created after August 31, 2026, or who share Claude Sonnet 5.5 transcripts across organizations, may need to adjust their workflows.
Related Coverage
- Anthropic's AI Replication Warning: 0 Rivals Respond [2026]
- Anthropic Warns AI Could Clone Itself on $55 TVs [2026]
- Nvidia China Share Drops to 34% as Huawei Hits 28% [2026]
- Meta Claims AI Frontier, Markets Give It 2% Odds [2026]
- OpenAI Math Papers Clear Lean Checks at Just 42% [2026]
