Anthropic says distillers now get 90 to 99 percent less data out of Claude

Anthropic calls distillation attacks “covert, industrial-scale campaigns”, often run through networks of fraudulent accounts. Its 12 October research post bases the estimate on early evidence.

Anthropic says Zhipu (Z.ai) drew on leading US models to build cyber capabilities into GLM-5.3: first Claude Fable 5, then other models once Claude’s cyber safeguards weakened its attacks. Reuters, reporting the post, said Z.ai had not immediately responded when asked for comment.

Three layers of defence

Anthropic first summarised Claude’s reasoning, which makes its transcripts less useful for distillation.

Distillers then tried to make Claude reveal its reasoning in full. The newer measures:

• Preserved thinking: with Claude Fable 5.1 and Claude Opus 5.5, API accounts created from 31 August 2026 can’t edit Claude’s prior context, which makes repeated extraction harder.
• A two-stage classifier that detects distillation attempts, which Anthropic says is roughly as robust as its safeguards against helping with bioweapons and wrongly blocks fewer than 0.1% of legitimate requests.
• Limits and bans: accounts that keep trying face stricter limits, persistent ones are banned, and since 24 September Anthropic again charges for requests its safeguards block.

Results and trade-offs

On its most capable generally available models, Anthropic says, the classifier detects every distillation technique it described in a September report, and Anthropic has shut down tens of thousands of distillation accounts. Refusing distillers’ paid traffic has cost it meaningful revenue, and it can’t tell how long the improvement will hold: its defences have not faced a highly sophisticated, sustained attempt to evade them.