What an industrial-scale data heist actually looks like

Distillation, in plain terms, is industrial-scale data theft. Operators run tens of thousands of anonymous accounts, treat Claude's outputs as teaching material, and use them to train a "student model" that approaches the original's capability but ships with substantially weaker safety guardrails. In an official blog post on October 12, 2026, Anthropic dropped the pretense and named the practice directly — openly calling out that the cyber capabilities of Zhipu's GLM-5.3 came through exactly this channel.

Anthropic's September threat-intelligence report had already laid out the attack patterns. The baseline was a network that held more than 20,000 fraudulent accounts online at the same time. One lab, on a single day, fired 12,000 differently worded probes, each one engineered to coax Claude into reciting its full internal reasoning.

The 80.4 vs 71.8 gap

The thing distillers actually steal is not the answer — it is the reasoning. Anthropic makes Claude write detailed chain-of-thought before responding, and those intermediate steps are the real target. Anthropic's controlled experiment makes the value of those tokens explicit: train a downstream model on Claude Opus 4.8 transcripts and you get 80.4% on SWE-bench Verified with full reasoning, versus 71.8% when the reasoning has been pre-summarized. That near 9-point gap is exactly why attackers will only settle for the full transcript.

The earliest defense was simple: have Claude summarize its own reasoning before showing it. It slowed attackers down, but the response was quick — attackers learned to use prompts that compelled Claude to spill its full thinking. Anthropic declared that wave broken in May and entered active-detection mode.

Three layers, each closing a different escape route

The October post describes a three-layer defense, with each layer aimed at a distinct evasion path.

Preserved thinking, enabled on Claude Fable 5.1 and Opus 5.5 for API accounts created on or after August 31, 2026, blocks callers from editing prior-turn reasoning blocks. That closes the proxy-network trick of shuttling reasoning between conversations, models, and accounts to leak it out. Anthropic also stops those models' reasoning from being readable by earlier models with weaker anti-distillation safeguards, and on Claude Sonnet 5.5 the reasoning transcript is visible only to the organization that produced it.

The two-stage classifier runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. It uses the same Constitutional Classifier approach Anthropic has already validated in bioweapon-prevention work — filtering not just direct asks but also recent rub-off methods like asking Claude to "translate your earlier reasoning into another language." Anthropic pegs the false positive rate below 0.1%.

Limits and substitutes form the floor: repeat offenders get usage throttles, persistent abusers get their accounts banned, and from September 24 onward, even blocked requests are now billed in the areas where the false positive rate sits below 0.1%. Genuine accounts lose the cost-free ability to probe for gaps.

The result: a 10x to 100x drop

Anthropic's framing is direct. After the classifier came online, the volume of Claude reasoning tokens extracted by distillers on Anthropic's own platform has remained "consistently 10 to 100x lower than before." On some days the leakage was too small to plot. Over the same window, Anthropic banned tens of thousands of associated accounts — most within two hours of starting a campaign. The 80.4% vs 71.8% spread on SWE-bench Verified is the underlying reason: distillers cannot settle for the summarized version.

Who got named, and the "easy-to-build model" grievance

The post names Zhipu and Moonshot AI in unusually direct terms. Anthropic writes that Zhipu distilled the cyber capabilities of leading US models during the development of GLM-5.3. It tried Claude Fable 5 first; once Anthropic's cyber safeguards degraded those attacks, Zhipu moved on to an older Claude model and to another lab's model. Moonshot, the post says, was caught running a quiet forward from Kimi requests into Claude — Anthropic flags one specific request that it links to a People's Liberation Army user analyzing CCTV surveillance footage.

Anthropic also makes the industry-wide case: not every lab has the ability or the willingness to deploy this kind of blocking. As long as there is a weaker counterpart out there — GLM-5.3 being a model whose safeguards "fail under simple attacks" — every other front-line guardrail gets walked around. The same GLM-5.3 is corroborated independently: CAISSI under NIST has assessed it as the most cyber-capable open-weights model released to date — a non-Anthropic reference point for the named accusation.

The cost does not come free, and the user pays it

There is a real bill attached to the three layers. Preserved thinking forced some developers to update their integration code. The classifier can misflag or block benign requests in fewer than 0.1% of cases, and from September 24 Anthropic charges for those blocked requests. The company has turned away meaningful revenue — trillions of tokens' worth of paying traffic from distillers. Anthropic itself concedes that it does not yet know how long the gains will hold; it has not yet seen a genuinely sophisticated, persistent bypass attempt.

In effect, the friction of anti-distillation has been shifted onto legitimate customers: you can be misblocked, and the cost of being misblocked lands on you. Anthropic is, at least, clear-eyed about that — paid customers' safety margins are bought, not free.

So what

Anthropic does not claim this is a finish line. The post is explicit that this remains a "cat-and-mouse game," and it openly calls on other frontier labs and platforms: one defender cannot close the hole alone. Zhipu and Moonshot are sitting in the "still owes an explanation" seat — both had been publicly reported on in September already, with stories on Moonshot forwarding requests to Claude and on GLM-5.3's guardrails folding under trivial adversarial pressure.

The actual shape of this story is not the 90-to-99% number. It is three shifts at once: (1) the marginal cost of stealing reasoning roughly doubles; (2) "spread the load across labs and clouds" stops being a viable strategy and starts demanding alignment; (3) the paying customer becomes the residual bearer of the "block correctly" cost. Anthropic's wager is that every other lab has to follow — because the worst-defended models will be the first to be drained. What remains is who moves first — or who gets their bypass published first.