Anthropic says its defenses have reduced the volume of Claude reasoning tokens extracted in suspected model-distillation attacks by 90% to 99%. Distillation uses outputs from a capable model to train another, and large-scale campaigns can spread requests across networks of fake accounts to avoid ordinary limits.
The company says attackers operated hundreds of thousands of accounts. It specifically named Chinese AI companies Zhipu and Moonshot, alleging that Zhipu sought cyber capabilities and that Moonshot secretly routed queries through Claude. Those are Anthropic’s claims, and the report does not provide an independent public accounting of every identified request.
Anthropic now exposes less of Claude’s internal reasoning, runs a classifier to detect extraction patterns and automatically bans accounts it flags. Tens of thousands of accounts have already been removed, according to the company.
The defenses carry a cost: Anthropic acknowledges that legitimate users can be caught by the detection system. Restricting chain-of-thought access may also reduce transparency for developers who use reasoning traces to debug model behavior. The result is a security trade-off between making industrial copying harder and preserving useful access for ordinary customers and researchers.