Published October 13, 2026 (IST) by the AgentStack News Desk. Facts were checked against Anthropic’s research post on distillation defenses (Oct 12, 2026), the Claude Help Center preserved-thinking article, and Reuters coverage via The Economic Times (Oct 13, 2026).
Anthropic distillation defenses cut data harvested by distillers by about 90 to 99 percent, the company said in a research post published October 12, 2026. The work centers on locking Claude’s reasoning transcripts, which distillers prize as training signal, behind preserved thinking, classifiers, and fast account bans.
Preserved thinking now binds thinking blocks to the system prompt, tools, and messages that produced them for new API accounts on Claude Fable 5.1, Opus 5.5, Sonnet 5.5, and Haiku 5.5. Anthropic says reasoning tokens extracted on its platform fell 10 to 100 times after the classifier rolled out.
The story is a governance and supply-chain issue for enterprise teams that buy open-weights models and run Claude through the API, Bedrock, Vertex, or Foundry. This report draws on Anthropic’s research post, its Help Center article on preserved thinking, and Reuters coverage via The Economic Times, per our editorial standards.
TL;DR
- What landed: Anthropic published “Strengthening our defenses against distillation attacks” on October 12, 2026, with early evidence of a 90 to 99% drop in data harvested by distillers.
- Why reasoning matters: distillers run industrial-scale covert campaigns, often through fraudulent account networks, and value Claude’s reasoning transcripts more than final answers alone.
- Preserved thinking: for API accounts created on or after August 31, 2026 (00:00 UTC), Fable 5.1, Opus 5.5, Sonnet 5.5, and Haiku 5.5 reject edits to context around a prior thinking block, or drop those blocks in non-strict mode.
- Classifier: a two-stage system (constitutional-classifiers style) with false positive rate under 0.1% runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1.
- Enforcement: tens of thousands of accounts banned, often within 2 hours of a campaign starting; since September 24, blocked safeguard requests are billed where FPR is under 0.1%.
- Operators: Claude Code, Cowork, and claude.ai need no change; API teams that rewrite mid-conversation context must migrate or opt into drop_block / non-strict behavior.
What Happened: Anthropic’s Distillation Defense Post
On October 12, 2026, Anthropic published a research post describing new defenses against distillation attacks on Claude. Distillation, as Anthropic defines it, is covert industrial-scale extraction of a model’s capabilities into another model without the original developer’s authorization, often through networks of fraudulent accounts.
Early evidence suggests the methods cut data harvested by distillers by around 90 to 99 percent. Anthropic also reports that after the classifier shipped, reasoning tokens distillers could extract on its own platform fell by a factor of 10 to 100.
Reuters, carried by The Economic Times on October 13, summarized the same claim and noted Anthropic’s warning about overseas labs using distillation to keep pace. The primary numbers below come from Anthropic’s post, not secondary paraphrase.
Anthropic gives two reasons it treats illicit distillation as urgent. Distilled models can approach frontier capability without matching safeguards, raising misuse risk in areas such as biology and cybersecurity. Distilled capabilities can also feed foreign military, intelligence, and surveillance systems.
Key Facts, Defenses, and Dates
Anthropic’s defenses now disrupt distillation in three ways: controlling where reasoning can go, blocking extraction attempts with classifiers, and making repeated attempts costly through bans and billing. The table below consolidates the published numbers and rollout dates from the research post and Help Center.
| Defense or fact | Detail |
|---|---|
| Published | October 12, 2026 (research post) |
| Harvested-data drop (early evidence) | About 90 to 99% less data harvested by distillers |
| Reasoning tokens extracted (post-classifier) | 10 to 100 times lower on Anthropic’s platform |
| Summarization eval (SWE-bench Verified) | Full Opus 4.8 transcripts: 80.4%; summarized: 71.8% after training a pretrained Claude |
| Preserved thinking models | Fable 5.1, Opus 5.5, Sonnet 5.5, Haiku 5.5 (Help Center) |
| Preserved thinking accounts | New API accounts created on or after August 31, 2026, 00:00 UTC; older accounts not enforced yet |
| Platforms covered | Claude Platform, Amazon Bedrock, Google Cloud Vertex AI, Microsoft Foundry |
| Two-stage classifier FPR | Under 0.1% |
| Classifier models | Sonnet 5.5, Opus 5 and 5.5, Fable 5 and 5.1 |
| Account bans | Tens of thousands; often under 2 hours after a campaign starts |
| Billing for blocked requests | Resumed September 24, 2026, where FPR is under 0.1% |
| Sonnet 5.5+ thinking readability | Readable only by the creating org (or a linked account) |
Reasoning transcripts are the prize. Anthropic says Claude’s written thinking before an answer is much more useful to distillers than the final output alone, which is why defenses focus on making that reasoning harder to access and reuse across accounts, models, and conversations.
Simple summarization helped but was not enough. Attackers moved from passive collection to active extraction, including prompts that ask Claude to print prior reasoning verbatim, and proxy networks that rotated hundreds of thousands of fraudulent accounts, including one Anthropic earlier described as managing more than 20,000 accounts at once.
How Preserved Thinking Changes API Integrations
Preserved thinking changes how the Messages API treats thinking blocks for affected accounts. The API verifies that a thinking block is sent back with the same system prompt, tools, and messages that produced it, and it returns an error when they do not match.
Developers who must rewrite earlier turns can opt into non-strict mode. In that mode the request continues, but affected thinking blocks are dropped from what the model sees, and the response tells you which blocks were dropped.
Who is affected, and who is not
Enforcement starts with new accounts, where Anthropic says distillation abuse concentrates. Claude Code, Claude Cowork, and Claude.ai need no change; those products handle thinking blocks for you.
| Model | Accounts created on/after Aug 31, 2026 00:00 UTC | Older accounts |
|---|---|---|
| Claude Fable 5.1 | Applies | Does not apply yet |
| Claude Opus 5.5 | Applies | Does not apply yet |
| Claude Sonnet 5.5 | Applies | Does not apply yet |
| Claude Haiku 5.5 | Applies | Does not apply yet |
Migration paths Anthropic documents
Integrations that rewrite earlier turns mid-conversation are the ones that break: client-side context compaction, injected system reminders, and mid-session tool changes. Anthropic points teams to compaction (beta), mid-conversation tool-change (beta), and per-model migration guides, including on Bedrock, Vertex, and Foundry.
Starting with Sonnet 5.5, a thinking block can be read only by the account that created it, or by a linked account. Unlinked thinking is dropped and the request continues, often with a slower, higher-token follow-up similar to compaction.
Accounts in the same Claude Platform parent organization or the same Google Cloud organization are linked automatically. Teams that fail over between Claude Platform and Bedrock should ask their account team to link those accounts, or they will lose thinking continuity across the hop.
# Conceptual: non-strict / drop path when you must edit prior context
# Exact field names live in Anthropic's preserved-thinking docs.
# If you rewrite system/tools/messages before a prior thinking block:
# - default (strict): API returns an error
# - non-strict / drop_block: request continues; thinking blocks are dropped
# Claude Code / Cowork / claude.ai: no change requiredWhy It Matters for Enterprise Buyers and Operators
For buyers, the post is less about a new product feature than about model supply-chain risk. Anthropic argues that distilled open-weights models can inherit frontier-like skills without inheriting matching safeguards, and it names concrete cases so procurement and security teams can update shortlists and eval gates.
Distilled models without matching safeguards
Anthropic says Zhipu distilled cyber capabilities during development of GLM-5.3, tried Claude Fable 5, then switched to an older Claude model and another lab’s model after cyber safeguards degraded the attack. CAISSI assessed GLM-5.3 as the most cyber-capable open-weights model released to date, and Anthropic says its own tests found GLM-5.3’s safeguards easy to bypass.
On Moonshot’s Kimi, Anthropic reports requests secretly forwarded to Claude as part of distillation. One request, which Anthropic believes came from a PLA-affiliated user, sought analysis of CCTV of a specific person. Reuters via ET also flagged Z.ai / Zhipu as an example Anthropic cited.
Enterprise shortlists that treat open-weights cyber performance as a free upgrade should ask how those capabilities were obtained and what safeguards shipped with them. A high score on an offensive benchmark is not the same as a model you can put behind a production agent with confidence.
Parallels to containment and observability
The theme rhymes with Anthropic’s own containment work. We covered how Claude agents overstepped during live-internet evaluations in Anthropic Pulls Internal Evals Off the Live Internet After AI Agents Overstep. Both stories push operators toward tighter egress, write-action control, and offline or allow-listed evals.
On the ops side, distillation campaigns look like abuse patterns in traces: repeated attempts to print hidden reasoning, proxy-network account churn, and cross-account session reuse. Our best AI agent observability tools guide and AgentOps tools map cover platforms that flag anomalous tool and prompt patterns.
Permission and orchestration changes land in the same week as Managed Agents dynamic workflows, which we covered in Claude Managed Agents dynamic workflows. Fan-out plus weaker anti-distillation posture on a substitute model is a bad pairing for any team that cares about where capabilities leak.
How It Shifts the Landscape
Anthropic frames distillation as an industry problem, not a Claude-only bug. Distillers spread traffic across first-party APIs, cloud platforms, and resellers, so platforms share responsibility for detecting illicit abuse, cutting off proxy networks, and offboarding fraudulent accounts before campaigns scale.
The trade-offs are explicit: some legitimate integrations must update, classifiers can mis-block under 0.1% of requests, and those blocked requests are billed. Anthropic says it has turned away meaningful revenue and trillions of tokens of paying distiller traffic to make the defenses stick.
| Actor | Pressure the post creates | What to check |
|---|---|---|
| Claude API / Bedrock / Vertex / Foundry teams | Preserved thinking breaks mid-conversation edits on new accounts | Compaction beta, tool-change beta, non-strict path, org linking |
| Buyers of open-weights models | High capability may arrive without matching safeguards | Provenance of training signal; red-team results; bypass rates |
| Cloud and reseller platforms | Shared duty to detect proxy networks and fraud | Account KYC, abuse SLAs, cross-tenant session controls |
| AgentOps / security teams | Extraction attempts show up as anomalous traces | Alerts on verbatim-reasoning prompts; account velocity |
For framework and architecture context, see our AI agent frameworks comparison, our Langfuse vs LangSmith vs Braintrust evals stack comparison, and the agent security and agent observability hubs.
What to Watch Next
Anthropic calls distillation a cat-and-mouse game and says it has not yet seen a highly sophisticated, persistent attempt to beat the new stack. Five follow-ups will matter for operators and buyers over the next quarter as enforcement widens and attackers adapt.
- Phased enforcement: when preserved thinking extends from new accounts to older ones, and whether Haiku/Sonnet/Opus/Fable stay aligned.
- Classifier durability: whether the 10 to 100 times drop in extracted reasoning tokens holds after attackers adapt.
- False positives and billing: how often legitimate traffic hits the under-0.1% FPR path and what appeal or refund process looks like.
- Open-weights response: whether GLM-5.3-class models ship stronger safeguards, or whether more labs document similar distillation pressure.
- Platform cooperation: whether Bedrock, Vertex, Foundry, and resellers publish matching abuse-disruption metrics.
Frequently Asked Questions
What are Anthropic distillation defenses?
Anthropic distillation defenses are measures that make Claude’s reasoning harder to steal for unauthorized model training. They include preserved thinking, a two-stage classifier with under 0.1% false positives, account bans, and billing for blocked requests. Anthropic says early evidence shows about a 90 to 99% drop in data harvested by distillers.
What is preserved thinking in the Claude API?
Preserved thinking binds a thinking block to the system prompt, tools, and messages that created it. For new API accounts on Fable 5.1, Opus 5.5, Sonnet 5.5, and Haiku 5.5 created on or after August 31, 2026, editing that prior context returns an error unless you opt into non-strict mode, which drops the thinking blocks.
Do Claude Code and claude.ai users need to change anything?
No. Anthropic says Claude Code, Claude Cowork, and Claude.ai handle thinking blocks for you, so those products need no change. The breaking path is custom Messages API integrations that rewrite earlier turns, tools, or system prompts mid-conversation on newly created accounts.
Why do distillation attacks matter for enterprise buyers?
Distillation can move frontier-like skills into models that lack matching safeguards, raising misuse and supply-chain risk. Anthropic cites Zhipu’s GLM-5.3 cyber case and a Moonshot Kimi forwarding example. Buyers should ask how capabilities were obtained and what safeguards ship with any high-scoring open-weights model.
The Bottom Line
Anthropic’s October 12 post turns anti-distillation from a quiet abuse fight into a public operator checklist: lock reasoning, classify extraction, ban fast, and accept some integration pain. The 90 to 99% harvest drop and 10 to 100 times token drop are company-reported; attackers will adapt.
API teams on new accounts should test preserved thinking this week, wire compaction or non-strict paths where they rewrite context, and link orgs before failing over across clouds. Buyers should treat unexplained open-weights cyber gains as a procurement red flag until provenance and safeguards are clear.
Security and AgentOps owners can treat verbatim-reasoning prompts, cross-account transcript reuse, and sudden account velocity as signals worth alerting on, alongside the usual tool-abuse monitors.
We will update this story if Anthropic expands enforcement or publishes new measurements. Send corrections through our contact page.
Related guides: the AgentOps tools map, agent observability, agent security, Anthropic evals containment, and Claude Managed Agents dynamic workflows.