Anthropic cuts Claude reasoning token theft by 90 to 99 percent

Anthropic's disclosure centers on a specific tactic: distillation, in which companies systematically copy an AI model's capabilities to train their own, smaller models. According to Anthropic, attackers use networks of hundreds of thousands of fake accounts to extract reasoning tokens, the model's internal chain-of-thought steps.

The company says successful distillation attempts dropped sharply after its defenses went live, cutting the volume of extracted reasoning tokens by 90 to 99 percent. Anthropic now restricts access to Claude's internal reasoning steps, runs a classifier that detects extraction attempts, and automatically bans flagged accounts. Tens of thousands have already been banned.

Anthropic names Chinese companies Zhipu and Moonshot as participants. Zhipu allegedly siphoned cyber capabilities from leading US models for its GLM-5.3 model, while Moonshot secretly routed queries through Claude. Anthropic says the stolen capabilities could end up in foreign military and surveillance systems, and it is calling on other AI developers to adopt similar protections, while acknowledging that legitimate users are getting caught up in the process too.