Anthropic says it cut model copying by 90 to 99%
On 12 October, Anthropic published a detailed account of how it is fighting distillation and what the defenses cost. Distillation, in this sense, means sending millions of requests to a strong model and using its answers to train a cheaper copy, without the original developer's permission. Anthropic says early evidence shows its new methods have cut the amount of data distillers harvest by around 90 to 99%.
The post names names. Anthropic says Zhipu, the company behind the GLM models, distilled the cyber capabilities of leading US models while building GLM-5.3, and that requests to Moonshot's Kimi models were secretly forwarded to Claude. These are Anthropic's accusations, and the post does not include responses from either company.
What distillers want
According to Anthropic, what distillers want most is Claude's reasoning, the thinking it writes out before answering, because it teaches a smaller model how to reach an answer. Distillers use networks that control hundreds of thousands of fraudulent accounts, some created with false identities and stolen payment details. One network ran more than 20,000 accounts at once.
The three defenses
The first limits where reasoning can travel. For API accounts created on or after 31 August 2026, Claude Fable 5.1 and Claude Opus 5.5 use what Anthropic calls preserved thinking, which stops those accounts from editing Claude's earlier context. With Claude Sonnet 5.5, reasoning transcripts are visible only to the organization whose request produced them.
The second is a classifier, a filter that screens requests and blocks attempts to extract hidden reasoning. Anthropic says it is about as hard to get around as the filters that stop Claude from helping with bioweapons, and that it wrongly blocks fewer than 0.1% of legitimate requests.
The third makes repeat attempts costly: stricter usage limits for accounts that keep trying, bans for persistent ones, and, since 24 September, charges for requests blocked before Claude answers in areas where the false positive rate is below 0.1%. Anthropic says it has banned tens of thousands of accounts, often within two hours of a campaign starting.
The cost for everyone else
Anthropic admits it has not met its goal of leaving legitimate users untouched. Preserved thinking required some developers to change their integrations, the classifier blocks some harmless requests, and those blocked requests are billed.
What to do if you build on Claude
If your API account was created on or after 31 August and your code edits earlier turns of a conversation, read Anthropic's preserved thinking documentation before your next release. Then look at your usage reports for blocked requests, since those are now charged.
What we think
It is useful that a lab published both the numbers and the side effects. A rate under 0.1% sounds small until a high-volume app hits it every day, so the billing of blocked requests is the detail most teams should check first.
Sources