Anthropic Says New Defenses Cut Claude Reasoning-Token Extraction by 90–99%

Anthropic says its new anti-distillation defenses have cut the volume of extracted Claude reasoning tokens by 90 to 99 percent, according to the company's own figures as reported by The Decoder on October 13, 2026. The figures have not been independently verified.

What Anthropic reports

Distillation attacks systematically copy a model's capabilities to train other, typically smaller, models. Anthropic says the targeted material includes reasoning tokens, the model's internal chain-of-thought steps.

According to Anthropic:

• Attackers use networks of hundreds of thousands of fake accounts to run extraction at scale.
• Successful distillation attempts dropped sharply after the defenses went live.
• Extracted reasoning-token volume fell by 90 to 99 percent.
• Tens of thousands of accounts have already been banned.

The defenses

Anthropic describes three measures:

1. Restricted access to Claude's internal reasoning steps, which limits the raw material available for extraction.
2. A classifier that detects extraction attempts.
3. Automatic bans for flagged accounts.

Anthropic has not disclosed classifier accuracy, false-positive rates, or the exact scope of the reasoning-step restrictions in the material available. It has also not disclosed which models or API tiers are affected, and no pricing, context window, or model version changes were announced.

Named companies

Anthropic names two Chinese companies as participants:

• Zhipu allegedly siphoned cyber capabilities from leading US models for its GLM-5.3 model.
• Moonshot allegedly routed queries through Claude secretly.

These are Anthropic's allegations. Neither company's response is included in the source material. Anthropic also warns that the extracted capabilities could end up in foreign military and surveillance systems, which is the company's assessment rather than a demonstrated outcome.

Collateral damage

Anthropic acknowledges that legitimate users are being caught up in the enforcement. It did not provide figures for how many legitimate accounts were affected or what appeal process exists. The company is also calling on other AI developers to adopt similar protections.

What this means

The reported 90–99% drop is a self-reported metric. It measures extracted volume, not the amount of capability transferred, and Anthropic has not published the baseline or methodology. Treat it as directional until there is outside validation.

Restricting visibility into reasoning steps is the most consequential change for developers. Chain-of-thought traces are useful for debugging, evaluation, and building agent workflows, and they are also the richest distillation signal. Tighter access trades developer transparency for IP protection, and the admitted false positives show the cost. Teams with high-volume or unusual API usage patterns should expect more scrutiny and should watch for unexpected account flags.

Naming Zhipu and Moonshot also moves the dispute from general warnings to specific allegations against identifiable labs. That raises the likelihood of policy and commercial consequences, and of responses from the accused companies. Anthropic's call for industry-wide adoption suggests that similar reasoning-trace restrictions and extraction classifiers may spread across other frontier providers.