Anthropic says it has made it substantially harder for unauthorized users to extract the reasoning traces of its Claude models and use them to train competing systems. In a research post published on October 12, 2026, the company reported that its latest safeguards reduced the amount of reasoning data available to suspected distillers by roughly 90% to 99%.

The announcement matters because model distillation can be a legitimate machine-learning technique, but large-scale extraction of a proprietary model’s outputs without authorization raises questions about intellectual property, service abuse, and the safety behavior inherited by a student model. The important distinction is between the general technique and the specific activity Anthropic describes: covert campaigns using accounts and automated queries to harvest a model’s capabilities.

There is useful quantitative evidence in the announcement, but it needs careful interpretation. The results were reported by Anthropic itself; they are not an independent audit of the defenses, and the company acknowledges that it has not yet observed a highly sophisticated, persistent attempt to circumvent its latest safeguards.

What is AI distillation?

Knowledge distillation is a method of training a smaller or different model using information produced by a more capable model. Depending on the setup, that information may include final answers, labels, explanations, or other training examples. Distillation can be a legitimate way to make models more efficient or adapt them to a particular task.

Anthropic is describing a narrower problem: large-scale, unauthorized extraction intended to reproduce capabilities from a proprietary model. Its report says attackers sought Claude’s reasoning traces—the intermediate reasoning content available in certain contexts—because those traces may teach a student model more than final answers alone.

The distinction matters. A benchmark showing that reasoning traces can improve a student model does not, by itself, establish that every distillation project is improper. Authorization, access terms, data collection methods, and the way a system is deployed all matter.

The benchmark result: 80.4% versus 71.8%

Anthropic reports an experiment using SWE-bench Verified, a benchmark designed to evaluate whether models can resolve real software issues. In the company’s comparison, a pretrained Claude model trained on full reasoning transcripts from Claude Opus 4.8 achieved 80.4%, while a model trained on summarized versions of those transcripts achieved 71.8%.

That is an 8.6 percentage-point difference in the reported benchmark results. It supports a specific claim: in this experiment, the full transcripts were more useful for training the student model than the summarized transcripts.

It does not prove that every model trained on full reasoning traces will improve by the same amount. The outcome can depend on the student model, data selection, training recipe, evaluation setup, and the exact benchmark version. Nor should the scores be interpreted as a direct measure of the quality of Anthropic’s new defenses: this experiment compares two kinds of training data, rather than independently testing the full defense system.

Readers can consult the SWE-bench project for background on the software-engineering benchmark. The 80.4% and 71.8% figures above are Anthropic’s reported results, not a claim that SWE-bench independently verified Anthropic’s anti-distillation system.

How Anthropic says its defenses work

Anthropic describes several layers rather than one standalone filter.

1. Restricting how reasoning can be reused

The company says it introduced a measure called “preserved thinking” for Claude Fable 5.1 and Claude Opus 5.5. For new API accounts created on or after August 31, 2026, this prevents users from editing Claude’s prior context in ways that could make protected reasoning appear to be authorized for reuse.

The aim is to close a route in which reasoning blocks are moved between conversations, accounts, or models to persuade a system to reveal content that should remain protected.

2. Detecting extraction attempts

Anthropic says a two-stage classifier looks for requests that try to elicit hidden reasoning, including variations designed to evade earlier safeguards. According to the company, the classifier now catches the extraction techniques described in its September report on its most capable generally available models.

The company reports a false-positive rate below 0.1% for this system. That is a company-reported measurement; the public post does not provide an independent audit of the rate across all customers, languages, workloads, and edge cases.

3. Limiting repeat abuse

The report also describes stricter usage limits, account bans for persistent attempts, and charging for certain requests blocked before a model responds. Anthropic says it has banned tens of thousands of accounts associated with distillation campaigns, sometimes within two hours of a campaign beginning.

These measures may make automated extraction more costly, but they also create operational trade-offs. Legitimate developers may need to update integrations, and a classifier can occasionally block a benign request. Anthropic acknowledges both the integration burden and a non-zero false-positive rate.

What does the reported 90–99% reduction mean?

Anthropic says the number of reasoning tokens extracted by suspected distillers on its platform is now 10 to 100 times lower than before the new classifier was introduced. This is the basis for its headline estimate that the amount of data harvested has fallen by approximately 90% to 99%.

The measure is narrower than “AI model theft has fallen by 99%.” It concerns reasoning tokens that Anthropic estimates were extracted through its own platform. It does not measure all attempts across third-party providers, all data an attacker may already have collected, or the final capabilities of every model trained using that data.

The public report also says the company has not yet seen a highly sophisticated and persistent attempt to bypass the new defenses. Anthropic expects the situation to remain a continuing contest between defenses and attackers. That caveat is important: the reported reduction is encouraging evidence from the company’s own monitoring, not proof that the defenses are impossible to evade.

Reuters separately reported Anthropic’s announcement and its claims about the reduction. Its coverage is useful independent reporting of what the company said, but it is not an independent replication of the underlying security measurements. Read Reuters’ report.

What has been independently verified—and what has not?

The evidence should be separated into three categories:

  • Reported experiment: The 80.4% versus 71.8% SWE-bench Verified comparison is described in Anthropic’s technical post. It shows a difference between full and summarized training transcripts in that experiment.
  • Company telemetry: The 10–100-fold reduction in extracted reasoning tokens, the false-positive rate below 0.1%, and the number of banned accounts are measurements Anthropic reports from its own systems.
  • Independent confirmation: Reuters confirms the announcement and provides external reporting, but its article does not independently reproduce the experiments or audit the telemetry.

This is not a reason to dismiss the findings. Companies often have the best access to abuse telemetry on their own services. It is, however, a reason to label the evidence correctly and avoid turning a company’s measured internal outcome into a universal claim about the whole AI industry.

Why the issue matters to model developers and users

For AI developers, the report illustrates a practical tension: detailed model outputs can be valuable for legitimate product use, but they may also become training material for someone trying to reproduce a model’s capabilities. Defenses must distinguish between normal use and systematic extraction without blocking too many ordinary requests.

For businesses using AI APIs, stricter safeguards may affect workflows that manipulate prior context or rely on reasoning blocks. Developers should read the relevant API documentation, test integrations against current behavior, and avoid assuming that previously accepted context-editing patterns will continue to work.

For users choosing AI tools, the announcement is not a benchmark ranking of Claude against competing assistants. It does not show that Claude is better or worse at coding, writing, or reasoning than another model. It is primarily a report about protecting a model service from unauthorized extraction.

The bottom line

Anthropic’s October 12 report presents two notable figures: a student model scored 80.4% on SWE-bench Verified when trained on full reasoning transcripts, compared with 71.8% when trained on summaries; and the company says its new safeguards reduced reasoning-token extraction on its platform by 10 to 100 times.

The first is a reported benchmark experiment. The second is a company-reported security measurement. Neither should be presented as an independently verified, industry-wide result. Anthropic also acknowledges that sophisticated circumvention remains an open challenge.

The strongest conclusion is therefore measured: restricting access to detailed reasoning appears to reduce the usefulness of harvested transcripts in the reported experiment, and Anthropic’s internal monitoring indicates that its safeguards have significantly reduced observed extraction on its own platform. Independent evaluation over time will be needed to establish how durable the defenses are and how well the approach generalizes.

Sources

This article distinguishes Anthropic’s reported measurements from independently verified findings. Claims about the effectiveness of the new defenses should be revisited as further evaluations become available.