Illegal data scraping: Anthropic claims to have reduced the amount of data scraped from Claude by between 90 and 99 per cent

Preserved reasoning, a two-stage classifier, model partitioning: Anthropic details the arsenal deployed against laboratories that train their models using Claude’s responses.

Anthropic has provided an update on its efforts to combat distillation attacks – large-scale campaigns, often carried out via networks of fake accounts, designed to make Claude generate millions of responses and then train a rival model to imitate it. According to the company, the new measures have reduced the volume of data collected by distillers by between 90 and 99 per cent. It cites the case of Zhipu, which is alleged to have distilled the cyber capabilities of US models to develop GLM-5.3, and states that one network alone managed more than 20,000 fraudulent accounts.

Protecting the reasoning first

The main target of distillers is the reasoning that Claude generates before responding, which is far more informative than the final answer. After summarising this reasoning (a model trained on summaries achieved only 71.8 per cent on the SWE-bench Verified dataset, compared with 80.4 per cent using full transcripts), Anthropic observed attackers attempting to make it repeat the reasoning word for word. With Claude Fable 5.1 and Opus 5.5, the company introduced ‘preserved reasoning’, which prevents API accounts created on or after 31 August 2026 from altering the preceding context, and prohibits older, less secure models from reading this reasoning.

A two-stage classifier, modelled on safeguards against hazardous biological uses, also detects extraction attempts, with a false positive rate of less than 0.1 per cent, according to Anthropic. The company acknowledges that these measures come at a cost: it has foregone revenue and trillions of paid traffic tokens, and some legitimate customers have had to adapt their integrations.