Anthropic says new defenses have cut the volume of data harvested from Claude through distillation attacks by 90 to 99 percent, according to the company's September 2026 threat intelligence report. The report details how Anthropic has tracked, attributed, and disrupted illicit attempts to extract Claude's capabilities, with the focus falling mainly on reasoning, coding, and tool use.

Distillation, in this context, is a technique in which a rival collects large volumes of a stronger model's responses and uses those transcripts as training data for its own system. Framed that way, the contested asset is not the model itself but the record of its responses — which is why Anthropic's countermeasures concentrate on controlling what the model emits and degrading what that output is worth to a harvester.

Nearly 200 Million Exchanges, One Very Large Campaign

Anthropic said it attributed nearly million distillation-related exchanges across five separate campaigns in its latest report. The largest of the five stands out: Anthropic linked it to Alibaba's Qwen, and it involved more than 151 million exchanges between May and July 2026.

This is not the first time Anthropic has gone public on the issue. Back in February 2026, the company disclosed earlier campaigns that involved more than 16 million exchanges and relied on approximately 24,000 fraudulent accounts. Where the February disclosure put numbers to the campaigns themselves, the September report goes further by attaching a measurable outcome: how much less data the company says is actually getting out.

How the Defenses Actually Work

Anthropic describes a layered approach rather than a single silver bullet. Account bans sit at one level, metadata analysis and behavioral classifiers at others. On top of that, the company uses organizational attribution methods to connect activity back to the groups behind it.

Several of the defenses arrived with product updates. The Fable 5 update brought strengthened extraction classifiers, which are designed to flag usage patterns that look like systematic harvesting. It also introduced summarization features in Claude, and the summarization piece limits the usefulness of harvested material: if what comes out of the model is a condensed version rather than a full, step-by-step reasoning trace, the transcript becomes far less useful as training material.

Fable 5.1 then added a feature Anthropic calls “preserved thinking.” It prevents new API accounts from editing encrypted reasoning context. Reasoning traces are some of the most valuable material a distiller can get, and if fresh accounts cannot tamper with the encrypted reasoning context, one route for manipulating the model into exposing or reshaping that reasoning gets closed off.

Read together, the measures work on two fronts: making systematic harvesting harder to carry out unnoticed, and lowering the training value of whatever transcripts still get collected.

Anthropic Is Not Alone in This Fight

OpenAI has been working on the same problem. It released its own September 2026 report outlining techniques to disrupt similar distillation efforts, including a method called encrypted reasoning replay. That two competing labs published threat reports on the same problem within the same month underlines the shift: distillation defense has moved into public view as an industry-wide concern rather than staying an internal security matter.

There is also a safety argument embedded in all of this. Illicit distillation raises questions about whether the safeguards built into the original model carry over to the distilled copy. A lab can spend enormous effort training a model to refuse dangerous requests, but a copy trained on harvested outputs may not inherit those guardrails.

Anthropic draws a line between this kind of activity and legitimate research use. The distinction matters because distillation as a technique is not inherently problematic. The problem is doing it at scale, through fraudulent accounts, and against a provider's terms.

Anthropic itself acknowledges that illicit distillation efforts continue and that its safeguards will need to keep evolving. That caveat turns the headline number into a benchmark rather than a conclusion: the company presents the 90 to 99 percent reduction as the current state of an ongoing contest, with the report's attribution figures serving as the baseline for judging how that effort evolves.