What Anthropic announced
Anthropic said on Monday that safeguards limiting access to Claude's protected reasoning are working. It estimates data harvested in distillation attacks is down about 90% to 99%, and that the volume of reasoning tokens extracted on its platform is now 10 to 100 times lower than before the measures — figures it describes as early evidence from its internal monitoring.
Distillation, in this context, is not a student model learning in the open. It is repeated probing of a stronger model so a rival can train a cheaper model on what comes out. Anthropic, OpenAI and Google have all argued that the practice lets competitors reproduce frontier capability faster and at lower cost.
Anthropic added two operational details. It has made it harder to run repeated probes through proxy networks, and it says it has banned tens of thousands of accounts it linked to distillation campaigns. It described the detection system as roughly as robust as the safeguards that stop Claude helping with bioweapons, with a false-positive rate below 0.1%.
The name in the announcement
Anthropic alleges that Z.ai (Zhipu) attempted to extract Claude Fable 5's cybersecurity capabilities during GLM-5.3 development. According to Anthropic, Z.ai subsequently switched to an older Claude model and another company's model after encountering Fable's safeguards. In the Reuters report, Z.ai had not responded to a request for comment.
That matters for how to read the claim. Keep the claims separate: Anthropic says it introduced technical restrictions and banned tens of thousands of accounts; it separately attributes a GLM-5.3-related distillation campaign to Z.ai. The public evidence for both comes from Anthropic, and Reuters reported no immediate Z.ai response. The allegation is not, in the reporting available at publication time, an independent finding or a court ruling.
Read the range, not the headline
A reduction of 90% to 99% sounds precise. In terms of what remains, it is a tenfold-to-hundredfold range. Anthropic reports substantial variation in daily extraction, but does not publish enough underlying counts or methodology to independently reproduce the estimate.
Anthropic publishes a before-and-after chart of estimated daily extraction but not the underlying numerical series, a reproducible calculation of the 90–99% reduction, or a campaign-level breakdown. That limits independent verification of the magnitude and causes of the decline. Without more, a reader cannot tell how much of the drop reflects less extraction, fewer attempts, or extraction shifting to other models or providers — a displacement Anthropic itself acknowledges attackers attempt.
The false-positive figure needs the same care. Anthropic reports a classifier false-positive rate below 0.1%, meaning some benign requests may be misidentified or blocked. That is not necessarily the percentage of legitimate developer accounts banned. The company does not disclose the absolute number of affected legitimate requests or how many account bans were successfully appealed.
A practical angle for Claude users
Legitimate Claude integrations can be affected by the new safeguards, particularly when they depend on modifying preserved reasoning context. Anthropic acknowledges that some developers have had to update their integrations and that benign requests can occasionally be blocked.
Anthropic acknowledges the trade-off: some legitimate integrations require changes, a small proportion of benign requests may be blocked, and certain blocked requests are now billable — it resumed charging for certain blocked requests on September 24, 2026. If you build on Claude, the concrete homework is checking whether your integration touches preserved reasoning, and keeping an appeal path ready rather than assuming a block notice explains itself.
Sources
- [1] Anthropic, "Strengthening our defenses against distillation attacks" (October 12, 2026) — primary source for the figures and safeguard descriptionsRead source
- [2] Anthropic, September 2026 Threat Intelligence Report — additional detail on the alleged Zhipu campaign
- [3] Reuters, "Anthropic says new safeguards sharply reduce AI distillation attacks" (October 12, 2026), as syndicatedRead source