Michael JohnsonOn October 12, Anthropic said new anti-distillation measures reduced the amount of Claude reasoning extracted by malicious actors through its platform by 10–100 times. The company described a multilayered system that makes it harder to reveal hidden reasoning, tracks the movement of requests between accounts and models, and blocks suspicious activity. This matters to API developers for two reasons: the protection changes how integrations behave, and some blocked requests are now billed.
Distillation trains a smaller model on the answers of a more powerful system. Anthropic considers complete records of reasoning that Claude generates before its final answer especially valuable for this purpose. In the company’s early tests, a model trained on full transcripts from Claude Opus 4.8 scored 80.4% on SWE-bench Verified; training on shortened versions produced a score of 71.8%. These figures apply to a specific test and Anthropic experiment, not to a universal measure of model quality.
Protection covers multiple extraction routes
The first layer reduces the amount of reasoning revealed. According to Anthropic, after this measure was introduced, attempts became more aggressive: requests began explicitly demanding hidden reasoning, while networks of intermediaries and numerous fake accounts were used. The company says one such network controlled more than 20,000 accounts at the same time.
The new measures control where protected reasoning fragments can be moved. Anthropic lists transfers between conversations, models, and accounts as ways to circumvent individual safeguards. The company says a two-stage classifier now detects all the distillation techniques described in its September report on its most capable publicly available models.
Anthropic measures the effect by counting reasoning tokens that distillers managed to extract specifically on its platform. After the classifier was introduced, this figure fell by a factor of 10–100; on some days, the volume was too small to measure. The company also reported blocking tens of thousands of accounts linked to distillation. These figures describe Anthropic’s own telemetry, not the total volume extracted through third-party clouds and inference providers.
What changes for developers
The safeguards have already affected some legitimate integrations. Anthropic says the preserved reasoning format required updates from some developers, while classifiers incorrectly flag or block harmless requests in fewer than 0.1% of cases. Since September 24, the company has charged for requests stopped before a response is generated in categories with this stated false-positive rate, including distillation.
The practical takeaway for teams using the API: after changes to reasoning handling, check which response fields the application reads and stores, and how it handles refusals or blocks before generation. Also account for the possibility that a billed, blocked request may incur costs without returning a useful answer. This is particularly important for automatic retries: repeating the same request does not correct the classification and may increase costs.
In its description of the new measures, Anthropic acknowledges that the system remains part of an ongoing race with attackers: the company does not know how long the reduction will last, and it has not yet observed a highly persistent attempt to circumvent the updated safeguards. The clearest practical change is already in place: developers need to account for updated reasoning handling, the possibility of rare blocks, and charges for some rejected requests.