Anthropic says stronger Claude defenses cut extracted reasoning by 90–99%

Anthropic disclosed on October 12, 2026, that stronger defenses against unauthorized copying of Claude’s capabilities have sharply reduced the reasoning data attackers can extract. Its early estimate puts the reduction at roughly 90–99%. The defenses go beyond banning accounts: they restrict how reasoning can move through Claude’s systems, with some costs falling on legitimate developers.

The target is unauthorized distillation: generating large numbers of responses from a capable model, then using them to train another model to imitate it. Anthropic describes the attacks it faces as covert, industrial-scale campaigns, often operating through fraudulent accounts. Its defenses focus primarily on protecting reasoning transcripts rather than only the final answers Claude gives users.

Why the reasoning is worth protecting

Reasoning transcripts are the thinking Claude writes before producing an answer. Anthropic says these records are especially valuable for distillation because they help a smaller model learn how Claude reaches a result, not just what it outputs. An early defense replaced full reasoning with summaries, making the material less useful for training.

The company tested that difference by training a pretrained Claude model on transcripts from Claude Opus 4.8. It then measured performance on SWE-bench Verified, a coding benchmark. Training on the summarized reasoning produced a lower score than training on the full transcripts—a company-run comparison showing why access to the underlying reasoning matters.

Closing routes around the summaries

Attackers responded by trying to make Claude reveal its hidden reasoning, Anthropic says. Some moved protected reasoning between conversations to make Claude believe they already had permission to see it. Others used models with weaker protections or shifted between accounts after bans. The strengthened defenses address those routes through access controls, request screening and enforcement.

• Lock down prior context. On Claude Fable 5.1 and Opus 5.5, preserved thinking prevents API accounts created on or after August 31, 2026, from editing Claude’s prior context. Anthropic says this makes repeated extraction attempts through account networks harder.
• Limit where reasoning travels. Anthropic prevents those models’ reasoning from being read by earlier models with weaker defenses. Claude Sonnet 5.5 reasoning transcripts are accessible only to the organization whose request produced them.
• Screen extraction attempts. A two-stage classifier—a system that identifies suspect requests—has undergone internal and external attack testing. Anthropic updates it when new techniques succeed, including attempts to extract reasoning through translation or tags alongside an answer.

The classifier runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. Persistent extraction attempts trigger tighter usage limits and account bans. Anthropic says it has banned tens of thousands of accounts associated with distillation, often within two hours of a campaign starting.

A smaller leak, with costs for customers

Anthropic measures effectiveness by estimating how many reasoning tokens attackers extract on its own platform. After the classifier was introduced, that quantity was consistently 10 to 100 times lower; the company describes reductions of 100-fold or more after full implementation. It does not yet know how long the gains will last and says the defenses have not faced a highly sophisticated, persistent circumvention attempt.

The costs are already concrete. Preserved thinking has required some developers to update their integrations. Anthropic reports a classifier false-positive rate below 0.1%, but acknowledges that benign requests can still be blocked. Since September 24, it has resumed charging for certain requests blocked before Claude responds, including distillation-related blocks where that low error rate applies.

Anthropic also says it has turned away meaningful revenue and trillions of tokens’ worth of paying distillation traffic. It argues that other platforms must help: attackers distribute requests across its API, cloud platforms and other providers. Detecting abuse and removing fraudulent accounts, it says, cannot be the model developer’s responsibility alone.