Anthropic Says New Defenses Cut Distillers' Harvest of Claude Reasoning by About 90–99%, Names Zhipu's GLM-5.3

Anthropic says it has cut the Claude reasoning that distillers extract on its platform by 10 to 100 times, which it describes as reducing the data they harvest by about 90 to 99%. The claim comes from a research post dated Monday, October 12, in which the company also says Chinese lab Zhipu distilled the cyber capabilities of leading US models while building GLM-5.3. Reuters reported the figures, as published by The Economic Times.

What Anthropic changed

Anthropic says its defences focus on Claude's reasoning transcripts, which it calls the most valuable data for distillers, and now work in three ways:

• Controlling where reasoning goes: with Claude Fable 5.1 and Opus 5.5, "preserved thinking" stops new API accounts, created on or after August 31, 2026, from editing Claude's prior context. With Sonnet 5.5, reasoning transcripts are accessible only to the organisation whose request produced them.
• Blocking extraction: a two-stage classifier of the kind described in its constitutional classifiers research runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. Anthropic says it is "roughly as robust as those that prevent Claude from helping build bioweapons," with a false-positive rate below 0.1%.
• Raising the cost of retries: stricter limits and bans for repeat attempts and, since September 24, charges for requests blocked before Claude responds in areas where the false-positive rate is below 0.1%.

The results it reports

After the classifier was introduced, reasoning tokens extracted by distillers on Anthropic's own platform have been "consistently 10 to 100 times lower than it was before," the post says. Anthropic says it has banned tens of thousands of accounts, often within two hours of a distillation campaign starting.

It is also explicit about what it does not know: "We don't yet know how long these gains will last," and "we have yet to see a highly sophisticated and persistent attempt to circumvent them." The post says the measures cost Anthropic "meaningful revenue" and required some developers to update integrations.

The Zhipu case

Zhipu tried to distill Claude Fable 5, Anthropic says, but switched to an older Claude model and another lab's model after finding that Claude's cyber safeguards degraded its attacks. The post cites the US Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) as assessing GLM-5.3 the most cyber-capable open-weights model released to date, and says Anthropic's own research found GLM-5.3's safeguards easily bypassed, which we covered in September.

Limits

• The 90–99% and 10–100x figures are Anthropic's own platform measurements, not an independent audit; Reuters' report relays them.
• The Zhipu account is Anthropic's allegation.

Sources

• Anthropic: Strengthening our defenses against distillation attacks (October 12, 2026)
• The Economic Times (Reuters): Anthropic says new safeguards sharply reduce AI distillation attacks (October 13, 2026)
• Times of AI: Anthropic Red Team: Open-Weight GLM-5.3 Nearly Matches Mythos Preview on Exploit Building