Anthropic reports that its new defenses have driven down by 90 to 99 percent the volume of reasoning traces attackers manage to extract from Claude.
Distillation is the technique in play. An attacker probes the model’s internal chain of thought and then feeds those traces into training a smaller, cheaper system — one that gains part of the original’s capability while skipping the research cost.
Two Chinese firms, Zhipu and Moonshot, were named by Anthropic as participants. According to the company, Moonshot routed queries through Claude to harvest responses, while Zhipu drew cyber capabilities out of leading US models for its GLM-5.3.
Scale drove the effort. Anthropic has described attackers operating networks of hundreds of thousands of fake accounts, treating the extraction as an industrial operation rather than a one-off experiment.
Three measures form the response. Raw reasoning steps are now behind restricted access, a classifier scans for extraction patterns, and accounts that get flagged are banned automatically.
Enforcement carries a cost. Tens of thousands of accounts have been removed, and Anthropic acknowledged that legitimate users are getting swept up along the way.
Other developers are being urged by Anthropic to adopt comparable protections. How to price the tradeoff between aggressive detection and false positives is a decision each lab will make on its own.
