Anthropic Turns Away Revenue to Cut Distillation Up to 99%

Anthropic said on 12 October 2026 that new defenses have cut the amount of data harvested by distillers from Claude by around 90 to 99 percent, according to early evidence it cites in a research post. It says it has turned away “meaningful revenue and trillions of tokens’ worth of paying traffic” from distillers to get there.

Distillation attacks, in Anthropic’s description, are covert, industrial-scale campaigns to extract one model’s capabilities and replicate them in another. The post points back to a case from its September 2026 threat report in which, it says, Moonshot forwarded requests made to its Kimi models to Claude.

What Anthropic Says It Changed

Anthropic says its defenses now work in three ways: controlling where Claude’s reasoning can go, blocking and patching extraction attempts, and making repeated attempts difficult. It says the focus is almost entirely on making Claude’s reasoning harder for distillers to access, because those transcripts are the most valuable data for training a smaller model.

With Claude Fable 5.1 and Claude Opus 5.5, Anthropic says it introduced preserved thinking, which prevents API accounts created on or after August 31, 2026 from editing Claude’s prior context. With Claude Sonnet 5.5, it says reasoning transcripts are accessible only to the organization whose request produced them.

It says a two-stage classifier, of the kind described in its constitutional classifiers research, now runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. Anthropic says these safeguards are now roughly as robust as those that stop Claude helping build bioweapons, with a false positive rate of less than 0.1%.

What Was Posted on X

Anthropic’s own post on X of 12 October 2026, introducing the research post this piece is built on. In its words, it has made significant progress over the last few months in reducing the effectiveness of distillation attacks against Claude, and it links the post that explains how.

The Numbers in the Post

Anthropic says the number of reasoning tokens extracted by distillers on its own platform is now consistently 10 to 100 times lower than before the classifier, and that on some days it was too small to measure. It says it has banned tens of thousands of accounts associated with distillation, often in less than two hours after a campaign begins.

The post gives one test of why reasoning matters: a pretrained Claude model trained on full transcripts from Claude Opus 4.8 scored 80.4% on SWE-bench Verified, against 71.8% when trained only on summarized transcripts. In its February report, Anthropic says, one network managed more than 20,000 fraudulent accounts at once.

The Moonshot Case It Cites

In its September 2026 report, Anthropic says Moonshot AI silently forwarded customer requests to Claude instead of processing them with Kimi, and displayed Claude’s responses to users who thought they were using a Kimi model. In one instance over a ten-day period, it says, Moonshot relayed almost 300,000 customer requests, most of them routed to Opus, through a proxy network of 5,380 fraudulent accounts.

Anthropic says one of the requests Moonshot forwarded came from a user it assesses was likely affiliated with China’s People’s Liberation Army, who asked the model to analyze CCTV data about a single targeted individual from hundreds of cameras in Chengdu. The report puts the scale of distillation attacks attributable to Moonshot between May and July 2026 at over 23 million exchanges observed.

What It Costs Anthropic and Its Customers

Anthropic says the measures involve trade-offs for both itself and its customers. Some changes required legitimate users to update their integrations, and its classifiers can misidentify or block benign requests in fewer than 0.1% of cases. Since September 24 it has also resumed charging for requests blocked by its safeguards before Claude responds, in areas with a false positive rate below 0.1%.

It says the incentives in the industry often cut the other way, because defenses are expensive and illicit distillers are still paying customers. Anthropic says it is publishing its methods to show there is a workable alternative, and that platforms and other developers have a role in detecting abuse and offboarding fraudulent accounts.

Where This Sits

We covered Anthropic’s September allegations against DeepSeek and Moonshot when they were reported, and the basics of model distillation in our explainer.

The Structural Read

As we read it, the post puts a price on the problem without a number: Anthropic says it has turned away “meaningful revenue and trillions of tokens’ worth of paying traffic” from distillers, but does not say how much revenue.

As we read it, the defenses target reasoning rather than answers: Anthropic says the transcripts of Claude’s reasoning are the most valuable data for distillers, and its own test shows a model trained on full reasoning scoring 80.4% against 71.8% on summaries.

As we read it, Anthropic is also asking the rest of the industry to act: it says distillers spread traffic across its API, cloud platforms and other inference providers, and that platforms have a role in offboarding fraudulent accounts.

Three Implications

DEVELOPERS ON CLAUDE Anthropic says preserved thinking has required some developers to update their integrations, and that since September 24 it charges for requests its safeguards block before Claude responds.

RIVAL MODEL MAKERS Anthropic says its efforts would be undermined if attackers could easily access similarly capable models without similar anti-distillation safeguards, citing Zhipu’s GLM-5.3.

CLOUD AND INFERENCE PLATFORMS Anthropic says platforms can materially slow distillation by quickly detecting and disrupting abuse and by offboarding fraudulent accounts.

The Business Engineer Lens

This story maps onto the Business Engineer framework The Four Intelligence Moats.

The framework puts it this way: “If you understand how each data pipeline becomes a moat — and how each moat decays — you understand the strategic structure of the entire AI stack.”

As we read it, distillation is one way a moat decays: Anthropic says distillers aim to generate millions of responses from Claude and use them to teach a smaller model, and its post describes the cost it is accepting to slow that down.

What Is Not Established

The 90 to 99 percent and 10 to 100 times figures are Anthropic’s own estimates of extraction on its own platform; the post does not give the amount of revenue it turned away, and we have not seen an independent audit. The Moonshot figures come from Anthropic’s September report. Anthropic’s posts do not include a response from Moonshot. Anthropic says it does not yet know how long the gains will last and has yet to see a highly sophisticated and persistent attempt to get around the new safeguards.

The Bottom Line

Anthropic says its new defenses cut what distillers can harvest from Claude by around 90 to 99 percent, at the price of turning away paying traffic and adding friction for some legitimate users. The case it uses to explain why is its September finding that Moonshot routed almost 300,000 Kimi requests to Claude in ten days.