Anthropic blocks 99 percent of Claude distillation attempts, sacrificing revenue

Anthropic says defense mechanisms deployed over recent months have cut the data that "distillers" managed to extract from Claude by roughly 90 to 99 percent. Distillation is a covert industrial operation: networks of fake accounts send millions of requests to a large model, harvest the responses — especially the chain-of-thought reasoning the model produces before its final answer — and train a smaller model that mimics the capabilities without paying the development cost. According to the company, the technique has been used by overseas AI labs to close the gap with U.S. firms in a fraction of the time and budget.

Anthropic highlights two primary risks. First, distilled models approach frontier capability but are released without equivalent safeguards, enabling misuse in areas such as biology and cybersecurity. Second, capabilities obtained through distillation are being embedded in the military, intelligence and surveillance systems of foreign states. Anthropic does not settle for general warnings; it names names.

The Zhipu and GLM-5.3 case

Researchers say the Chinese company Zhipu distilled cyber capabilities from leading U.S. models during development of GLM-5.3. An attempt to distill Claude Fable 5 failed when the defenses degraded the quality of the attacks, so the operators switched to an older Claude model and a model from another lab. The U.S. Center for Advancing Innovation and Standards for Superintelligence (CAISSI) determined that GLM-5.3 is the highest-cyber-capability open-weights model published to date. Independent Anthropic testing showed that GLM-5.3's guardrails can be bypassed easily and that the model is willing to develop an end-to-end exploit.

The Moonshot and PLA request case

A second example: Moonshot's Kimi models quietly routed requests to Claude as part of a distillation effort. One request came from a user Anthropic assesses is affiliated with China's People's Liberation Army (PLA) and asked the model to analyze surveillance-camera footage of a specific individual. This is the kind of capability distillers are after — not general-knowledge queries, but targeted surveillance and attack tasks.

The price Anthropic pays

The stricter defenses carry a tangible cost: the company gave up significant revenue and trillions of tokens of paying traffic identified as distillation. Research and product teams invested heavily, and some changes forced legitimate customers to update their integrations. Anthropic acknowledges this is a problem every model developer must confront and hopes the public disclosure will help other platforms understand the trade-offs and why the cost is worth it.