Anthropic Says It Cut Attempts to Extract Claude’s Reasoning Data by 90% to 99%

Anthropic said it strengthened defenses against attempts to extract large amounts of information about the reasoning process of its conversational AI, Claude—known as reasoning tokens—and reduced the amount extracted by 90% to 99%. The company said it has restricted access to reasoning data, deployed classifiers to detect signs of extraction, and introduced a system that automatically suspends accounts flagged for suspicious activity. It says it has suspended tens of thousands of accounts to date.

How to Prevent Large-Scale Access to Claude

At the heart of the issue is “distillation,” a method of training a smaller, separate model using the output of a powerful AI model as training material. It is a legitimate technique for making a company’s own models more lightweight, but it can also be used to send large numbers of queries to another company’s model and use its responses to copy its capabilities wholesale. Anthropic says it is concerned about organized extraction of the latter kind.

According to the company, attackers are using networks of hundreds of thousands of fake accounts. Each account is kept to a level of activity that makes it look like an ordinary user, while the network as a whole gathers an enormous volume of responses. It is a tactic one might call “account swarm warfare,” rather than a human-wave attack.

What the attackers are after are reasoning tokens—in other words, the internal steps a model takes before arriving at an answer. If they can obtain not just the final answer but also the chain of reasoning behind it, they can teach another model “how to think.” It is like taking not only the finished dish to imitate its taste, but also the recipe and its instructions.

Anthropic’s response has three main parts: restricting access to Claude’s internal reasoning steps, running classifiers to detect extraction attempts, and automatically suspending accounts deemed suspicious.

What the Numbers Show About the Measures—and Their Limits

Anthropic says the volume of reasoning tokens extracted fell by 90% to 99% after its defenses were activated. The company also says successful distillation attempts dropped sharply after the measures were introduced. The range is broad, but the claim is that extraction was reduced to no more than one-tenth of its previous level.

Another important point is the side effect the company itself acknowledges: legitimate users can also be caught by its detection systems. The more finely tuned the net for blocking abuse, the more likely it is to ensnare ordinary users and businesses, too. This familiar trade-off in security measures is no exception for AI services.

Developers who use the service heavily and business systems that incorporate automation tools may exhibit behavior that looks like a sign of extraction. Going forward, the balance between the strength of anti-abuse measures and operating the service without disrupting normal use will affect how easy it is to use.

What Does Naming Companies Mean?

Anthropic named Chinese companies Zhipu (智譜) and Moonshot as parties involved. According to the company, Zhipu drew cyber-related capabilities from leading U.S. models and used them to support its own GLM-5.3. Anthropic also accused Moonshot of secretly routing queries through Claude. These are claims made by Anthropic, and the companies’ views could not be confirmed in the materials released this time.

Anthropic also raised the possibility that capabilities extracted in this way could find their way into foreign military and surveillance systems. The company’s framing of the issue as a national security concern, rather than merely commercial imitation, stands out.

In another move, the company is urging other AI developers to adopt similar defenses. Securing the doors at just one company would have limited value if information could simply be extracted through another entry point. The question is whether the industry can coordinate its efforts.

The generative AI race is expanding beyond the contest to build smarter models into a contest to identify and control who uses those models and how. The unglamorous defensive technologies—such as detecting fake accounts and restricting access—are likely to play an increasingly important role in determining AI companies’ competitiveness.