Anthropic makes it harder for rivals to copy Claude AI, saying new safeguards cut data harvested in distillation attacks by 90% to 99% and sharply reduce exposed reasoning tokens.

Anthropic makes it harder for rivals to copy Claude AI

Anthropic makes it harder for rivals to copy Claude AI, and the company says its new defenses are already changing the economics of trying to steal its work. On October 12, Anthropic said fresh safeguards have reduced the amount of data harvested from Claude in so‑called distillation attacks by roughly 90% to 99%. In practical terms, the number of reasoning tokens attackers can extract is now 10 to 100 times lower than before the changes.

That’s a big claim, but it matters. Distillation is one of the quieter ways AI companies can borrow capability from rivals: instead of building every behavior from scratch, a lab trains a smaller or competing model on outputs from a stronger one. Anthropic argues that when this happens without permission—or without comparable safety work—it turns frontier research into a shortcut for competitors.

Why distillation is such a sore point

Think of Claude’s reasoning as a highly detailed, expensive training signal. A rival doesn’t need Claude’s weights to learn from it; they need enough high‑quality examples of how Claude reasons through hard problems.

Anthropic says it has seen coordinated attempts to do exactly that. In earlier disclosures, it said it identified campaigns using tens of thousands of fraudulent accounts and millions of exchanges with Claude. More recently, it alleged that several China‑based AI developers, including Alibaba, DeepSeek, Moonshot, Xiaomi, and Zhipu, were involved in large‑scale extraction campaigns.

The company’s latest announcement doesn’t just repeat those concerns. It says the new controls have made the attacks materially less effective, especially at scale.

How Anthropic is blocking the copycats

Anthropic’s approach is less about one magic filter and more about making the whole attack chain expensive and unreliable.

First, it is restricting access to Claude’s protected reasoning. The company says this directly reduces the volume of reasoning data distillers can collect.

Second, it is targeting the infrastructure attackers use. Anthropic says it has made it harder to use proxy networks to repeatedly probe Claude, disrupting attempts to spread requests across many addresses or accounts to avoid detection.

Third, it is enforcing consequences. Anthropic says it has banned tens of thousands of accounts connected to suspected distillation activity and has reinstated fees for intercepted malicious requests. That last part matters: if an attack costs money even when it fails, the incentive to run it at industrial scale drops.

A safety classifier with a very low false‑positive rate

One of the more interesting technical claims is Anthropic’s two‑stage classifier system. The company says it can intercept distillation attempts at a rate comparable to its biosecurity defenses, while keeping false positives below 0.1%.

That’s important. A defense that wrongly blocks legitimate developers would create a different problem: paying customers would get frustrated, and competitors could use Anthropic’s security posture as a reason to switch platforms. A low false‑positive rate suggests Anthropic is trying to make the system selective rather than blunt.

Anthropic names Z.ai and GLM‑5.3

Anthropic specifically cited Chinese AI startup Z.ai, also known as Zhipu, saying it attempted to distill Claude while developing GLM‑5.3. The company has previously raised similar concerns about DeepSeek, Moonshot, and MiniMax.

These allegations are serious, but it’s worth separating what has been publicly stated from what has been independently proven. Anthropic is describing patterns it says it observed in its own systems. The named companies have not all responded in the same way, and public reporting has not established every detail of intent, authorization, or outcome.

Still, the broader point stands: frontier labs are treating model behavior as intellectual property, and they’re starting to defend it like it.

Why this matters beyond Anthropic

This isn’t just an Anthropic story. It’s a signal for the whole AI industry.

If you’re building a frontier model, your competitive advantage is no longer only your architecture, your compute budget, or your data pipeline. It’s also how well you can prevent rivals from extracting your model’s behavior through APIs, agents, and automated workflows.

For enterprises, the practical question is different: will these protections degrade legitimate use? Anthropic says no, at least not meaningfully, and points to the low false‑positive rate as evidence. But customers will still want clarity on how security controls affect latency, pricing, and access to advanced reasoning features.

What comes next

Expect this to become a standard part of AI platform competition. We’ll likely see more labs talk about:

• Reasoning protection and output controls.
• Account verification and abuse detection.
• Rate limits tied to suspicious behavior.
• Pricing designed to make bulk extraction uneconomical.
• Legal and policy disputes over what counts as authorized use.

Anthropic’s message is clear: copying Claude is getting harder, and the company wants rivals to know it. Whether that slows the broader race for capable AI is another question. But it does raise the cost of taking shortcuts.

Summary

Anthropic says its new distillation defenses have cut the data rivals can harvest from Claude by 90% to 99%, while reducing exposed reasoning tokens by 10 to 100 times. The company is restricting reasoning access, disrupting proxy networks, banning suspect accounts, and using a low‑false‑positive classifier to catch abuse. It has also named Z.ai/Zhipu and GLM‑5.3 in its allegations, continuing a broader dispute over how frontier AI capabilities are copied and protected.