Cybersecurity news: Anthropic says new safeguards cut data harvested in distillation attacks by 90–99% — reasoning tokens extracted by distillers now run 10–100x lower than before. Attackers had shifted from passive collection to active extraction: one lab tested 12,000 requests, each with a different trick to make Claude reveal its thinking. If you ship an AI product, the same war is aimed at you. Five questions to check your defenses.
Short answer: don't expose raw reasoning, detect systematic probing, scope outputs per customer, and ban persistent extractors. Anthropic's playbook — preserved thinking, extraction classifiers, proxy-network blocking — is the template; scale it to your product.
Direct answer: if your product exposes raw reasoning traces through its API and you are not detecting systematic high-volume probing, assume the answer is yes. Distillation attackers probe quietly at first — one lab fired 12,000 requests, each with a different trick. Take the 60-second check below to find your gaps.
Answer for the AI product you ship or manage.
Scale of the problem: in one documented case, a single lab fired 12,000 requests at Claude, each using a different trick to extract reasoning — and Anthropic has banned tens of thousands of accounts for extraction behavior.
| Layer | What it does |
|---|---|
| 1. Preserved thinking | Newer models (Fable 5.1, Opus 5.5, Sonnet 5.5) block context-editing extraction; reasoning transcripts visible only to the org that made the request |
| 2. Extraction classifiers | Two-stage classifier (constitutional-classifiers lineage) detecting reasoning-extraction attempts; red-teamed inside and out; <0.1% false positives; "roughly as robust as bioweapon refusal" |
| 3. Persistent-attacker pressure | Stricter limits for repeat probers, account bans (tens of thousands banned), and — since Sep 24 — charging for blocked requests in <0.1%-FP areas so attacks cost money |
Sources: Reuters · Unite.AI (technical detail) · Straits Times. Anthropic also named Chinese startup Z.ai (Zhipu) as attempting to distill Claude for its GLM-5.3; Z.ai didn't comment.
Training a smaller or rival model on the outputs — especially the reasoning traces — of a more capable model, reproducing its capabilities faster and cheaper than training from scratch. Labs call hostile, large-scale distillation an attack because it appropriates their training investment.
Three layers reported October 2026: (1) preserved thinking — newer Claude models prevent API accounts from editing prior context to reveal reasoning, and reasoning transcripts are org-scoped; (2) a two-stage classifier detecting extraction attempts, red-teamed internally and externally, with fewer than 0.1% false positives; (3) stricter limits and bans for persistent extractors, plus blocking proxy-network probing.
Don't expose raw reasoning traces; detect systematic high-volume probing and extraction patterns; scope outputs so one account can't read another's; throttle and ban persistent extractors; and monitor for the known tricks (verbatim-reasoning requests, translation or tag-wrapping evasions).
It typically violates the model provider's terms of service, and providers ban accounts for it. Anthropic has also framed large-scale distillation by rivals as a safety and national security risk. This page is general information, not legal advice.