Anthropic says distillation fell 90-99%. Read the range

Anthropic says it has nearly shut down the industrial-scale copying of Claude. Read the numbers as Anthropic's own, because that is what they are.

In a post published October 12, "Strengthening our defenses against distillation attacks," Anthropic said new safeguards cut data harvested in distillation attacks by about 90% to 99%. Separately, it said the number of reasoning tokens extracted by distillers is now 10 to 100 times lower than before. The company also said it banned tens of thousands of accounts linked to distillation campaigns, and made it harder to run repeated probes through proxy networks.

Distillation, in Anthropic's framing, is not ordinary learning from outputs. It is a covert, industrial-scale campaign to extract one model's capabilities and replicate them in another without authorization, often run through networks of fraudulent accounts. The company argues distilled copies circulate without proportional safety guardrails, which makes the practice a biosecurity, cybersecurity, and national security problem, not just an IP dispute.

The post names a name. Anthropic cited Chinese AI startup Z.ai, also known as Zhipu, as an example of a company that attempted to distill capabilities from Claude while developing its GLM-5.3 model. Anthropic alleges Z.ai tried to extract Claude Fable 5's cybersecurity capabilities, then switched to an older Claude model and another company's model after encountering Fable's safeguards. Z.ai did not immediately respond to Reuters' request for comment. Keep the claims separate: Anthropic's technical measures and account bans are its own account of its own systems. The Z.ai attribution is Anthropic's allegation. It is not an independent finding and not a court ruling.

Now the range. A 90% to 99% reduction sounds precise. In terms of what remains, it is a tenfold-to-hundredfold range. Anthropic publishes a before-and-after chart of estimated daily extraction but not the underlying numbers, a reproducible calculation, or a campaign-level breakdown. That limits independent verification of how big the drop is and what caused it. Without more, a reader cannot tell how much of the decline reflects less extraction, fewer attempts, or extraction shifting to other models or providers. Anthropic itself acknowledges attackers attempt displacement.

The false-positive figure needs the same care. Anthropic says its detection system is roughly as robust as the safeguards that keep Claude from helping build bioweapons, with a false-positive rate below 0.1%. That is a classifier rate. It is not the share of legitimate developer accounts banned. Anthropic does not disclose the absolute number of affected legitimate requests or how many account bans were successfully appealed.

The part that affects ordinary Claude users is operational, not geopolitical. Anthropic tightened access to Claude's protected reasoning, including preserved-thinking controls that apply to specified new API accounts. The classifier covers Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. Anthropic acknowledges some developers have had to update integrations, and that benign requests can occasionally be blocked. And on September 24, it resumed charging for certain requests its safeguards block, in categories including distillation where the false-positive rate is confirmed below 0.1%. A blocked request used to be free. Now an attempt can cost money even when it fails.

If you build on Claude, the homework is concrete. Check whether your integration touches preserved reasoning context. Keep an appeal path ready rather than assuming a block notice explains itself. And budget for the possibility that a blocked request shows up on the bill.

What remains unknown: whether the 90-99% figure holds once attackers adapt, how much extraction moved elsewhere, and how many legitimate developers get caught in the classifier. Anthropic's post is early evidence from internal monitoring, in its own words. Treat it that way.

Related: Anthropic's 2026 usage policy update set the terms these safeguards enforce, and the CyberXero campaign showed what happens when Claude tooling is turned to offense. This post is the defensive half of the same story.