Anthropic’s October 12, 2026, post describes expanded safeguards intended to make it harder to extract Claude’s reasoning for training another model. The company says reasoning-token extraction on its own platform fell by a factor of 10 to 100 after it introduced a classifier. Separately, Anthropic describes an estimated 90%–99% reduction in data harvested by distillers. These are different company-reported measures, not evidence that all distillation has stopped. Anthropic’s account of the safeguards and results
Distillation is a way to train one model using another model’s outputs. Anthropic’s measures focus on limiting access to reasoning traces, detecting extraction attempts and responding to repeated attempts. They also have consequences for some legitimate API users.
How Anthropic says the safeguards work
Anthropic describes several layers. “Preserved thinking” restricts edits to Claude’s prior context for certain new API accounts. For Claude Sonnet 5.5, reasoning transcripts are accessible only to the organization whose request produced them. A two-stage classifier is intended to detect extraction attempts, while stricter usage limits and account bans target repeated activity.
The classifier is red-teamed using manual and automated methods, Anthropic says. The company also describes monitoring for successful extraction and updating safeguards when it identifies new evasion techniques. These measures aim to make repeated harvesting harder; they do not amount to a claim that every attempt is prevented.
Which Claude models and API accounts are covered
Anthropic gives different protections different scopes. Its stated model and account coverage is:
| Safeguard | Covered models or accounts | What Anthropic says it does |
| Preserved thinking | New API accounts created on or after August 31, 2026, for Claude Fable 5.1 and Claude Opus 5.5 | Prevents those accounts from editing Claude’s prior context and prevents earlier models with weaker anti-distillation safeguards from reading those models’ reasoning. |
| Organization-bound transcripts | Claude Sonnet 5.5 | Makes reasoning transcripts accessible only to the organization whose request produced them. |
| Two-stage classifier | Claude Sonnet 5.5; Claude Opus 5 and Claude Opus 5.5; Claude Fable 5 and Claude Fable 5.1 | Detects techniques for extracting reasoning. |
| Account enforcement | Accounts repeatedly attempting to extract reasoning | Can lead to stricter usage limits and bans. |
Anthropic says it has banned tens of thousands of accounts associated with distillation, sometimes less than two hours after a campaign began. That enforcement figure refers to accounts the company associated with distillation; it does not expand the model list covered by the classifier.
What the reported reduction measures
Anthropic’s 10-to-100-times figure concerns estimated reasoning-token extraction on its own platform after the classifier was introduced. The company says this reduction came in addition to the effect of its preserved-thinking changes. Its separate estimate of around 90%–99% less harvested data describes the broader result, not the same statistic.
That distinction matters: a lower count of reasoning tokens extracted from Anthropic’s platform is not a direct measure of every model trained from Claude outputs, nor of the capabilities of any resulting model. Anthropic says it has not yet seen a highly sophisticated, persistent attempt to evade the newer safeguards and does not know how long the reported gains will last.
What API users may notice
Anthropic acknowledges that preserved thinking has required some developers to update their integrations. It also reports a classifier false-positive rate below 0.1%, while noting that benign requests can still be misidentified or blocked.
Anthropic says it resumed charging on September 24 for certain requests blocked before Claude responds in safeguard areas where the false-positive rate is below 0.1%, including distillation. The post does not specify a year for that date. The official Claude Developers post is relevant to the charging policy.
NeoTeo previously covered Anthropic’s claims about China-linked military and surveillance uses of Claude, including alleged distillation efforts. That earlier coverage concerns the reported activity; Anthropic’s October post focuses on safeguards intended to impede reasoning extraction.
What US legal analysis says about training on model answers
The US legal analyses by LegalLayer and Mondaq point to provider contract terms, access methods, possible trade-secret issues and copyright questions as relevant factors. They do not frame simply querying a commercial model and training another model on its answers as categorically illegal. This is a summary of secondary legal analysis, not a court ruling or case-specific legal advice.
