Anthropic says new defenses cut Claude reasoning token extraction by 90 to 99%
Anthropic says it is battling large-scale distillation attacks on its Claude models. In such attacks, companies systematically copy an AI model's capabilities to train their own, smaller models. According to Anthropic, its new defenses have cut the volume of extracted reasoning tokens, the model's internal chain-of-thought steps, by 90 to 99 percent. The attackers use networks of hundreds of thousands of fake accounts to pull this off.
Anthropic names Chinese companies Zhipu and Moonshot as participants. Zhipu allegedly siphoned cyber capabilities from leading US models for its GLM-5.3 model, while Moonshot secretly routed queries through Claude. The source adds that the stolen capabilities could end up in foreign military and surveillance systems.
On the defensive side, Anthropic now restricts access to Claude's internal reasoning steps, runs a classifier that detects extraction attempts, and automatically bans flagged accounts. Tens of thousands of accounts have already been banned. Anthropic is calling on other AI developers to adopt similar protections, although the company admits that legitimate users are getting caught up in the process too.
Key facts
- Anthropic says its new defenses cut the volume of extracted reasoning tokens (chain-of-thought steps) by 90 to 99 percent.
- Anthropic names Chinese companies Zhipu and Moonshot as participants; Zhipu allegedly siphoned cyber capabilities for its GLM-5.3 model, and Moonshot secretly routed queries through Claude.
- Attackers use networks of hundreds of thousands of fake accounts; tens of thousands of accounts have already been banned.
- Defenses: restricted access to Claude's internal reasoning steps, a classifier that detects extraction attempts, and automatic bans of flagged accounts.
- Anthropic admits that legitimate users are getting caught up in the process too.
Why it matters
Distillation lets a company copy a model's capabilities into its own smaller model, and Anthropic frames this as a systematic, industrial-scale problem for Claude. The reasoning tokens are the model's internal chain-of-thought steps, which is what Anthropic says the attackers were extracting. The company also says the stolen capabilities could end up in foreign military and surveillance systems, which turns a commercial dispute into a security argument.
Who it affects
Anthropic and the other developers of leading models are the direct targets; Anthropic is calling on other AI developers to adopt similar protections. Zhipu and Moonshot are named as participants. Ordinary Claude users are affected too: Anthropic itself admits that legitimate users are getting caught up in the restrictions and bans.
How to use it
This is not a product or tool to adopt. For other AI developers, Anthropic's described approach has three parts: restrict access to the model's internal reasoning steps, run a classifier that detects extraction attempts, and automatically ban flagged accounts. Legitimate users of Claude may see the effects of these measures.
How solid is it
The 90 to 99 percent reduction is Anthropic's own claim, reported second-hand by The Decoder. No date or time period is given for the reduction or for the bans, and no baseline against which the reduction is measured. The body text says 'by 90 to 99 percent'; the 'up to 99%' wording appears only in the headline. No evidence or technical detail supporting the allegations against Zhipu and Moonshot is given, and no response from either company is reported. The number of banned accounts is stated only as 'tens of thousands'.
Risks and caveats
Anthropic admits that legitimate users are getting caught up in the process, but no figure is given for how many are affected. The Zhipu allegation is stated as an allegation, and the military and surveillance use is described only as a possibility. The source does not say which other AI developers are meant or whether any have adopted similar protections, and it does not name which Claude models were targeted or how the classifier works.