Anthropic says it cut distillation harvesting 90–99%
Anthropic says new defenses have cut the data that distillers harvest from Claude by roughly 90 to 99 percent, and it names Zhipu and Moonshot as labs that drew on its models.
Anthropic says it has substantially strengthened Claude's defenses against distillation attacks. In a new research post, the company says early evidence shows these methods have reduced the amount of data distillers harvest by around 90 to 99 percent.
Anthropic describes distillation attacks as covert, industrial-scale efforts to copy a frontier model's capabilities, often run through networks of fraudulent accounts. Its defenses focus almost entirely on Claude's reasoning transcripts, which it calls the most valuable training data for distillers.
An early step was summarizing Claude's reasoning before showing it to users. In Anthropic's tests, a pretrained Claude model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified. Trained on summarized transcripts, it scored 71.8%. Attackers then switched to active extraction: prompting Claude to reveal its hidden reasoning, in one case testing 12,000 different prompts. They also built proxy networks controlling hundreds of thousands of fraudulent accounts.
The post names specific labs. It says Zhipu distilled the cyber capabilities of US models while building GLM-5.3. Zhipu tried Claude Fable 5, then switched to an older Claude model and another lab's model after Anthropic's safeguards degraded its attacks. Anthropic also cites a case where requests to Moonshot's Kimi were secretly forwarded to Claude, including one from a user it believes was linked to China's People's Liberation Army, who wanted to analyze CCTV footage of a specific individual.
Anthropic says the measures cost it meaningful revenue and trillions of tokens of paying traffic, and that some legitimate customers have had to update their integrations. The source text available here is truncated, so the full set of technical measures is not covered.