Anthropic says new safeguards have sharply reduced attempts to extract reasoning tokens from its Claude models. The company reports a decline of 90 to 99 percent, amid what it describes as large-scale efforts to copy AI capabilities for training other models.
How model distillation works
In the attacks described by Anthropic, companies make systematic queries to an existing AI model and use its responses to train a smaller model of their own. This process, known as distillation, can transfer capabilities without building them from scratch.
The reported activity involves networks of hundreds of thousands of fake accounts. Those accounts can make queries at scale, seeking both ordinary model outputs and reasoning tokens: steps that reveal Claude’s internal chain-of-thought process.
Anthropic’s stated reduction concerns extracted reasoning tokens. The report does not say that every kind of attempted model copying has stopped. Instead, the figure indicates that the company’s defenses have substantially lowered one specific form of extraction.
Anthropic names alleged participants
Anthropic identifies Chinese companies Zhipu and Moonshot as participants in the activity. It alleges that Zhipu siphoned cyber capabilities from leading US models for its GLM-5.3 model, and that Moonshot secretly routed queries through Claude.
The company warns that capabilities obtained this way could end up in foreign military and surveillance systems. That concern gives the dispute consequences beyond competition between AI developers: Anthropic says copied capabilities may be used in sensitive settings.
These claims are presented as Anthropic’s account of the activity. The source does not provide responses from Zhipu or Moonshot, nor does it describe their position on the allegations.
New controls target reasoning-token extraction
Anthropic says it has introduced several measures to make large-scale extraction harder. It now limits access to Claude’s internal reasoning steps, uses a classifier to identify suspected extraction attempts, and automatically bans accounts the system flags.
The company says tens of thousands of accounts have already been banned. Together, the restrictions and automated detection are intended to reduce the value of using fake accounts to collect Claude’s reasoning tokens.
Anthropic is urging other AI developers to adopt similar protections. Its appeal suggests that the company sees industrial-scale distillation as a problem that extends across the industry, rather than one that a single provider can address alone.
Safeguards can affect legitimate users
Automated defenses also bring a trade-off. Anthropic acknowledges that legitimate users are getting caught up in the process, meaning that accounts flagged as suspicious may include people who are using the service appropriately.
This tension is central to how providers respond to suspected extraction. Stronger restrictions may make bulk collection more difficult, while classification errors can interrupt access for ordinary users. Anthropic’s account describes both the reduction it reports and the cost that its enforcement can impose.
The company has not said in the source how it measures the reported 90 to 99 percent reduction, or how it distinguishes every legitimate use from an extraction attempt. What it does describe is a layered response: restrict internal reasoning access, detect suspicious patterns, and ban flagged accounts. Its call for other developers to follow suit frames those steps as a shared defense against large-scale copying.