Anthropic said on Monday, Oct. 12, that new defenses have sharply cut how much rival AI developers can take from its Claude models, without permission, for distillation, training one model to imitate another by learning from its answers. The company says early evidence suggests the measures have reduced the data these copiers harvest by around 90 to 99 percent. Anthropic describes the attacks as covert, industrial-scale campaigns, often run through networks of fake accounts, that let a company mimic the abilities of the most advanced models for a fraction of the time and cost of building them.
What copiers want most, Anthropic says, is Claude's reasoning, the working-out it writes before it answers, because it shows a smaller model how Claude reaches an answer and not just the answer itself. In an Anthropic test, a model trained on Claude's full reasoning scored 80.4 percent on a standard coding test, against 71.8 percent for one trained only on summaries of it. Anthropic started showing users only those summaries, and copiers turned to tricking Claude into revealing the full version. One lab tested 12,000 requests, each trying a different trick, the company says.
Anthropic says its defenses now work in three ways. An automated filter spots requests that try to pull out Claude's hidden reasoning; Anthropic says it is now about as hard to get around as the one that stops Claude from helping build bioweapons, and that it wrongly blocks fewer than 1 in 1,000 requests. On Claude Fable 5.1 and Claude Opus 5.5, developer accounts opened since Aug. 31, the kind people use to plug Claude into their own apps, can no longer edit earlier parts of a conversation, which Anthropic says makes it harder to keep retrying an extraction across many accounts. Older Claude models with weaker protections also can no longer read these models' reasoning, closing a route copiers used to pull it out through a less guarded model. Accounts that keep trying face tighter limits and then bans: Anthropic says it has banned tens of thousands of accounts linked to distillation, often less than two hours after a campaign begins.
Anthropic says copied models have been released without safety protections to match their abilities. It accuses the Chinese company Zhipu, now called Z.ai, of copying the hacking skills of leading U.S. models while building its GLM-5.3 model. Anthropic says Zhipu tried to copy Claude Fable 5, then switched to an older Claude model and another lab's model after Claude's cyber safeguards hampered its attempts. Z.ai did not immediately respond to a request for comment, according to a news report. Z.ai published GLM-5.3's trained files, so anyone can download it and run it on their own computers. In September, the U.S. National Institute of Standards and Technology found it the most capable model of that kind yet at finding and exploiting software flaws, though about four months behind the best U.S. models at those tasks. That assessment does not address whether Zhipu copied anyone.
The defenses come at a cost, the company says. Anthropic says it has turned away meaningful revenue from copiers, some developers have had to change their software, and since Sept. 24 it has again charged for requests its filters block before Claude answers in some areas, copying among them, so the rare ordinary request blocked by mistake is billed too. The 90 to 99 percent estimate covers only Anthropic's own platform, and Anthropic says copiers spread their traffic across its service, other companies' cloud platforms and other providers. Anthropic says it does not yet know how long the gains will last, expects a continuing cat-and-mouse game, and has yet to see a highly sophisticated and persistent attempt to get around its defenses.