Anthropic cuts Claude AI model distillation attempts by up to 90% with new safeguards

Last month, Anthropic found evidence that Chinese AI models, including DeepSeek and Moonshot unlawfully used Claude to give answer its users query. The company also identified nearly 200 million exchanges across five campaigns allegedly aimed at extracting capabilities from its AI models. The company said it had disrupted the activity and shared relevant information with authorities and industry partners where appropriate. In response to growing concerns over unauthorised attempts to replicate Claude, Anthropic has introduced new safeguards to strengthen its defences against AI model distillation.

In the latest blog, the company has announced that the changes to the way users access its Claude artificial intelligence models have significantly curtailed attempts to copy their capabilities, reporting a fall of between 90 and 99 per cent in the amount of reasoning data extracted through suspected distillation campaigns.

The company announced the results on Monday, describing a series of safeguards intended to make it harder for outside developers to replicate the behaviour of its models at scale. According to Anthropic, the volume of reasoning tokens obtained by suspected distillers is now “10 to 100 times lower than it was before”.

The measures come amid growing tensions over the development of advanced AI between the United States and China. Major technology companies, including Anthropic, OpenAI and Google, have raised concerns that competitors can use their systems to build capable alternatives without incurring comparable research and development costs.

How did Anthropic do it?

Distillation is a technique in which a smaller or less expensive AI model learns from the outputs of a more capable system. The approach has legitimate applications, including making AI models cheaper to operate and easier to deploy. However, companies argue that unauthorised extraction of their models' capabilities can give competitors access to valuable technical advances without equivalent investment.

Anthropic said some suspected campaigns involved repeated queries designed to obtain information about Claude's internal reasoning. The company has responded by limiting access to that information and strengthening its defences against attempts to circumvent restrictions.

It has also tightened controls against proxy networks, which can allow operators to distribute requests across multiple routes and make coordinated activity more difficult to detect. According to Anthropic, the changes have helped block extraction attempts and disrupt efforts to collect enough responses to reproduce its models' capabilities.

The company said it had terminated tens of thousands of accounts associated with suspected distillation activity. It identified Chinese AI developer Z.ai, also known as Zhipu, as an example of an organisation it accused of attempting to extract capabilities from Claude while developing its GLM-5.3 model.

Anthropic warned that such activity could have implications beyond commercial competition, particularly if copied systems inherit capabilities that could be misused. However, the reported reduction in extracted data is the company's own assessment; the information provided does not establish an independent verification of the figures or quantify the effect on competitors' finished models.

Anthropic also compared its detection safeguards with protections designed to stop Claude from assisting with the creation of biological weapons. It said the system's false-positive rate was below 0.1 per cent, suggesting that relatively few legitimate interactions were incorrectly flagged. The company did not, in the information provided, detail the methodology used to calculate that rate.

Biological threats and surveillance raise wider concerns

Preventing unauthorised model copying is only one part of Anthropic's safety efforts. In a separate report last month, the company described several suspected plots identified this year in which researchers allegedly tried to direct its models towards scientific work that could support the development of biological weapons.

The cases illustrate a difficult distinction for AI developers. The same biological knowledge can underpin beneficial research, such as vaccine development, while also providing information that could be used to engineer dangerous pathogens. Systems must therefore distinguish between legitimate scientific enquiries and requests that could materially assist harmful activity.

Anthropic said it had taken a cautious approach when assessing potentially dangerous biological prompts, reflecting the consequences of overlooking malicious intent. Yet overly restrictive safeguards could also interfere with legitimate research, leaving developers to weigh the risk of enabling abuse against the cost of blocking useful work.

The company's report covered a broader range of alleged misuse involving Claude over the preceding eight months. Among the cases it described were activities attributed to actors linked to the Chinese and Iranian governments that targeted dissident and diaspora communities for surveillance.

These allegations point to a wider set of risks than the cyberattacks that often dominate public debate about AI security. Advanced systems may also be exploited for monitoring vulnerable populations or helping users pursue dangerous scientific objectives. More fundamental concerns persist about whether increasingly capable AI agents will reliably follow human intentions, although the scale of real-world harm remains difficult to establish from cases documented in research or company investigations.

Anthropic's disclosures offer a picture of the competing pressures facing AI developers: protecting proprietary technology, supporting legitimate scientific work and limiting potential misuse. Its latest figures suggest that technical barriers can disrupt some extraction attempts, but they do not resolve the broader question of how effectively companies can prevent powerful AI capabilities from being used for harmful purposes.

Handpicked stories, in your inbox

Global stories. Indian perspective. Zero noise.

No Spam. Unsubscribe Any Time.

First Published:Oct 13, 2026, 09:52:19 IST