Anthropic says new safeguards for Claude Fable 5.1 and Claude Opus 5.5 have reduced the amount of data harvested by distillation attackers by roughly 90% to 99%, a change that could affect developers building on Claude and other AI platforms.
Distillation attacks use large numbers of accounts and automated requests to copy the behavior of a more capable model into a smaller one. Anthropic says the practice can let organizations reproduce frontier capabilities more cheaply while avoiding the safety controls built into the original model.
Claude reasoning tokens fall by 10 to 100 times after new safeguards
Anthropic said in its October 12 research post that the amount of Claude reasoning exposed to suspected distillers on its platform fell by a factor of 10 to 100 or more after its defenses were fully deployed. The company also said it has banned tens of thousands of accounts associated with distillation campaigns.
The protections focus on Claude's internal reasoning, which Anthropic says is more valuable for training a competing model than a final answer alone. The company uses a two-stage classifier to detect attempts to extract hidden reasoning and updates the system when it identifies new extraction techniques.
Preserved thinking binds Claude context to the account that created it
The central product change is called preserved thinking. For API accounts created on or after August 31, 2026, Claude prevents users from editing the prior context associated with its reasoning. Anthropic says attackers had moved protected reasoning between conversations, models and accounts to make Claude reveal it.
The feature was introduced with Fable 5.1 and is also included in Claude Opus 5.5. Anthropic says the controls are designed to have minimal effect on legitimate use, but acknowledged that some developers have had to change their integrations.
Developers moving Claude conversations need to preserve session context
Teams using Claude through the API should review workflows that edit, replay or transfer earlier messages and reasoning context. Integrations that depend on changing prior context may need to be redesigned for accounts covered by preserved thinking.
- Identify integrations that edit, replay or transfer Claude's previous reasoning context.
- Test those workflows with an API account created on or after August 31, 2026.
- Update the integration so each continued conversation stays tied to the account and context that generated it.
Anthropic says the new classifiers have a false-positive rate of less than 0.1%. Since September 24, the company has charged for requests blocked by safeguards in areas including distillation. Anthropic says preserved thinking has required some developers to update their integrations.
AI platforms face pressure to block capability theft without blocking users
The announcement broadens the security debate beyond data leaks and prompt abuse. If model capabilities can be copied at industrial scale, developers must protect both their intellectual property and the safeguards attached to it. Anthropic says preventing illicit distillation will require cooperation from frontier-model developers, cloud platforms and application providers.
The company describes the defenses as an ongoing cat-and-mouse effort rather than a permanent solution. It expects attackers to develop new extraction methods and says it will continue monitoring for successful attempts and updating its safeguards.
References
Anthropic. (2026, October 12). Strengthening our defenses against distillation attacks. Anthropic. https://www.anthropic.com/research/distillation-defenses
Anthropic. (2026, September 22). Introducing Claude Opus 5.5. Anthropic. https://www.anthropic.com/claude-opus-5-5