Anthropic Bans Tens of Thousands of Accounts and Slashes Distillation Data by 99%

Anthropic says the reasoning data that distillation attacks can extract from its platform has dropped by about 90% to 99%, leaving only a tenth to a hundredth of the former volume. Tens of thousands of related accounts have been removed, and some were banned less than two hours after they began distilling. The company used three defenses. First, it made reasoning reusable but hard to transfer: with preserved thinking, new API accounts that alter prior context can no longer reuse the original reasoning, and some models restrict reading by older models and access across organizations. Second, it applied its Constitutional Classifiers approach to distillation, using a two-stage classifier system to identify and block requests that try to extract Claude's full reasoning. Third, it rate-limits repeated probing, bans linked accounts that keep trying, and charges for requests blocked by its safeguards before Claude responds. In an internal experiment, Anthropic found that a model trained on full reasoning scored 80.4% on SWE-bench Verified, versus 71.8% for one trained only on summaries, an 8.6-point gap. That is why it kept full drafts private and showed only summaries. Attackers have tried to get Claude to restate hidden reasoning; one lab reportedly tried 12,000 requests, each with a different approach. From September 24, blocked requests in low-false-positive categories, including biology, distillation attacks and frontier model development, are charged again. Anthropic acknowledges that its classifiers can wrongly block legitimate requests, and those customers may also be billed.