Anthropic says new safeguards have reduced the amount of Claude reasoning data harvested through distillation attacks by about 90 to 99 percent. The company is restricting access to reasoning transcripts, screening requests that try to extract them and limiting accounts that make repeated attempts.
Distillation uses responses from one model to train another to imitate it. Anthropic says transcripts showing how Claude reaches an answer are especially useful for that purpose. Its estimate of the reduction comes from early evidence, and the company says it expects to keep updating its defenses as attackers change their methods.
Anthropic restricts access to Claude’s reasoning
With Claude Fable 5.1 and Claude Opus 5.5, Anthropic introduced a feature called preserved thinking. It prevents API accounts created on or after August 31, 2026, from editing Claude’s prior context. The company also prevents earlier models from reading those models’ reasoning. With Claude Sonnet 5.5, reasoning transcripts are accessible only to the organization that made the request.
Anthropic also built a two-stage classifier to identify attempts to extract hidden reasoning. It runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. The company says its false positive rate is below 0.1 percent. It plans to use the classifier on future models that are similarly attractive to distillers.
Repeated attempts face limits and charges
Accounts that repeatedly try to extract reasoning face stricter usage limits, and Anthropic says it bans accounts linked to persistent distillation attempts. Since September 24, it has resumed charging for requests blocked before Claude responds in areas, including distillation, where its safeguards have a false positive rate below 0.1 percent.
Anthropic estimates that, after it introduced the classifier, distillers extracted 10 to 100 times fewer Claude reasoning tokens on its platform than before. It says it has banned tens of thousands of accounts associated with distillation. The changes have required some developers to update their integrations, and benign requests can still be blocked and charged.
Anthropic says it is monitoring for new extraction techniques and updating its safeguards when it finds them. It plans to apply the classifier to future models that it considers similarly attractive to distillers.
