Anthropic Hardens Anti-Distillation Defenses: Extraction Down 90–99%, Tens of Thousands of Accounts Banned, Z.ai Named

On October 13, Reuters reported that Anthropic announced new anti-"distillation" safeguards on Monday, along with a quantified scorecard rarely seen in the history of model security: data harvested in distillation attacks against Claude has fallen by about 90% to 99%, and the reasoning tokens extracted by distillers are now 10 to 100 times lower than before. Anthropic has banned tens of thousands of accounts linked to distillation campaigns and, in a rare move, publicly named Chinese AI company Z.ai (Zhipu, 2513.HK), accusing it of attempting to distill capabilities from Claude while training GLM-5.3 — warning of safety and national security risks. Z.ai did not immediately respond.

One sentence of context for non-specialists: "distillation" means training a weaker model (the student) on the API outputs of a stronger model (the teacher), cheaply "copying" the teacher's capabilities. You skip the compute and data bills the teacher paid; with enough high-quality question-answer pairs — especially the teacher's reasoning traces — the student can approach the teacher on targeted capabilities. Reuters framed the backdrop: amid intensifying U.S.-China competition, Anthropic, OpenAI, and Google all treat distillation as a key threat because it lets rivals "reproduce advanced capabilities more quickly and at lower cost."

The key facts: what Anthropic disclosed

• The numbers: data harvested in distillation attacks down ~90%–99%; "reasoning tokens extracted by distillers" now 1/10 to 1/100 of previous levels (Anthropic's figures).
• The methods: restricting access to Claude's reasoning process; cracking down on proxy networks repeatedly probing Claude's protected reasoning — blocking extraction attempts and crippling large-scale distillation operations.
• The scale: tens of thousands of accounts linked to distillation campaigns banned.
• The brag: Anthropic says the safety system is "roughly as robust as those that prevent Claude from helping build bioweapons," with a false positive rate under 0.1%.
• The naming: Chinese AI startup Z.ai (Zhipu, HKEX 2513.HK) cited as having attempted to distill from Claude while developing GLM-5.3; Anthropic warned of safety and national security risks.

Distillation attack chain vs Anthropic's anti-distillation defenses. Attackers bulk-extract reasoning tokens via proxy networks to train rivals; the defense restricts reasoning access and banned tens of thousands of accounts, claiming a 90%–99% drop in extraction. All figures are Anthropic's unilateral claims. Diagram drawn from Reuters reporting.

Take one: the model security war, quantified in public for the first time

AI safety talk is usually qualitative — "we take safety very seriously," "we've invested heavily." Anthropic broke character with a quantitative battle report: 90%–99%, 1/10–1/100, tens of thousands of accounts, a <0.1% false positive rate. Why would a famously cautious company suddenly start "reporting numbers"?

The most direct reading: deterrence. Distillation economics rest on ROI — as long as bulk API probing costs less than building it yourself, the incentive exists. Publishing "your harvest is down to 1%–10%" rewrites the attacker's equation directly: $10,000 of API spend that used to steal $1M worth of training data now steals $10K–$100K worth, plus the sunk cost of tens of thousands of banned accounts. The numbers speak to would-be attackers first, the press and public second.

One level deeper, this is the moment a long "shadow war" became an open one. Anti-distillation used to be silent: rate limits, bans, altered API responses — no explanations, no names. Now Anthropic reports numbers and names a listed company. Model security now has public scorecards, public adversaries, and a public front — a new variable for the whole industry's expectations.

Take two: naming Z.ai escalates from "silent bans" to "public attribution"

The highest-density sentence in the whole report is the naming of Z.ai. Note the details: Anthropic didn't name an obscure shop but a Hong Kong-listed company (2513.HK); not a vague "Chinese firm" but a specific allegation tied to a specific model, GLM-5.3; and it framed the charge at the level of "safety and national security risks."

"Public attribution" has precedent in cybersecurity (naming state-backed hacking groups), but this is a first in frontier-model competition. The signal outweighs the legal weight: Anthropic is telling everyone — we can see distillation, and we dare say the name out loud. That's an explicit warning to anyone else doing the same: you could be named next.

Of course, the naming is one-sided. Z.ai did not immediately respond, and Reuters could not obtain comment. With a single source, readers should treat "Z.ai distilled Claude to train GLM-5.3" as "Anthropic's allegation," not established fact. Even so, a U.S. frontier lab publicly accusing a Chinese listed company of "stealing capabilities" marks a new phase of U.S.-China AI competition — the battlefield extending from "whose model is stronger" to "who is stealing whose capabilities."

For VibeFix's long-time readers there's another layer: this site previously covered Zhipu's GLM-5.3 landing on Amazon Bedrock and GLM-related legal developments. Read together — the same company's model sold on global clouds while accused of training on a rival's outputs — the juxtaposition is a perfect footnote to the "U.S.-China model rivalry" theme.

Take three: how to read "90%–99%"

Responsible coverage must watermark these numbers as vendor claims — unilateral, unaudited. A few readings worth flagging:

• Unknown baseline: "Down 90%–99%" is relative. If the prior extraction volume was astronomical, the remaining 1%–10% could still be substantial. Anthropic disclosed no absolute scale.
• The metric is "harvested data volume": that's the attacker's revenue, not attempt counts. Anthropic also says it blocked attempts and banned tens of thousands of accounts — the revenue drop could come from "smaller hauls per attempt" (restricted reasoning access) or "fewer attempters" (deterrence working). Different meanings.
• "<0.1% false positives" is equally unilateral: which legitimate users get caught? Heavy reasoning-API researchers, third-party evaluators — Anthropic didn't say whether their experience degrades. And the "as robust as bioweapon-misuse prevention" analogy is rhetoric, not a technical argument.

But don't slide into "everything a vendor says is PR" nihilism either. Tens of thousands of banned accounts is a verifiable scale of action (banned users talk), and naming a listed company carries legal and reputational risk — Anthropic wouldn't print the name without confidence in its evidence. The sane reading: trust the direction (anti-distillation is escalating and working), discount the precision.

What it means for vibe coders and Claude API users

This story sits closer to ordinary developers than it looks:

• The red line is explicit: training competing models on Claude API outputs violates Anthropic's Terms of Service. Enforcement will only intensify after this. If your product involves "fine-tuning small models on big-model outputs," confirm your upstream ToS allows it — not just Anthropic's; OpenAI's and Google's terms prohibit it too.
• Reasoning access may tighten: a core anti-distillation lever is "restricting access to the reasoning process." If you depend on chain-of-thought/reasoning traces (displaying reasoning steps, post-processing on reasoning), prepare for the visibility, granularity, and quotas of reasoning content to tilt toward "extraction-proofing." What you can get today you may not get tomorrow — don't architect on "full reasoning access" as an invariant.
• Watch for collateral damage in eval workflows: bulk, automated, high-frequency probing of model behavior is exactly the traffic signature of distillation attacks — and also of legitimate model evaluation and security testing. A <0.1% false positive rate sounds tiny, but when your whole business runs on the API, being that 0.1% is a 100% outage. Keep a communication channel with the provider when running large-scale automated calls.

Context: why distillation became a "key threat"

Distillation isn't new — academics have studied model distillation for nearly a decade. It became a "key threat" through three compounding shifts: first, frontier training costs ballooned into the billions, making the steal-vs-build arbitrage unprecedentedly large; second, the rise of reasoning models made "the reasoning process" itself the most valuable training data — final answers are easy to imitate, hundred-step reasoning chains are not, and that's exactly what distillation wants to steal; third, U.S.-China tech competition turned "capability diffusion speed" into a national security question — distillation stopped being a commercial dispute and became a strategic one about "how fast the other side catches up."

Anthropic's three moves — restricting reasoning access, hitting proxy networks, mass bans — map neatly onto those shifts: choke the most valuable data (reasoning traces), break the scaling mechanism (proxy networks), raise the attack's cost (bans). A coherent "make stealing expensive" playbook.

Open questions

First, will OpenAI and Google follow with their own numbers? Anthropic opened the quantified-scorecard era. If rivals stay silent, their defenses look like they have "nothing to report"; if they follow, do the numbers become an arms race? Their security blogs in the coming months will be worth watching.

Second, will Z.ai respond? Named listed companies typically respond within 24–48 hours. How this plays out — response, denial, silence, countersuit — will decide the first field test of "public attribution" as a weapon.

Third, where's the boundary on reasoning-access tightening? Anthropic says "restricting access to the reasoning process," but many legitimate advanced uses of Claude (agent self-reflection, step display for complex tasks) depend on reasoning visibility. The defense-vs-UX tradeoff will land in concrete API changes — developers should keep watching.

One-line summary: Anthropic turned a long shadow war into an open one for the first time — reporting numbers, naming names, drawing red lines. Discount the precision of "90%–99%," but not the direction: frontier labs now treat "theft prevention" as important as "capability building." For developers building on the Claude API, reading this red line matters as much as reading the next model release.

Primary source: Reuters (2026-10-13; dateline Tue, 13 Oct 2026 01:07:25 +0000). Figures and characterizations are Anthropic's unilateral claims, marked as vendor claims; opinion sections are the author's judgment.