Anthropic says new anti-distillation defenses cut harvested data by 90-99% -- and legitimate customers now pay part of the cost
Preserved thinking locks newer API accounts out of editing Claude's prior context, a classifier blocks reasoning-extraction attempts, and since September 24 blocked requests in those areas are billed again.
Anthropic said on October 12 that a new set of defenses against distillation, in which another lab harvests Claude's outputs at scale to train its own model, has cut the amount of data distillers extract by around 90 to 99%, based on early evidence. The defenses target Claude's reasoning transcripts, which Anthropic calls the most valuable data for this purpose. Anthropic says it has banned tens of thousands of accounts tied to distillation, often less than two hours after a campaign began, and that the effort has meant turning away meaningful revenue, including trillions of tokens of paying traffic from distillers.
What changed for API customers
Three mechanisms are involved, and two of them reach legitimate users. First, with Claude Fable 5.1 and Claude Opus 5.5, Anthropic introduced preserved thinking: API accounts created on or after August 31, 2026 can no longer edit Claude's prior context. Anthropic also blocked earlier models from reading these models' reasoning, and with Claude Sonnet 5.5, reasoning transcripts are available only to the organization whose request produced them. Second, a two-stage classifier now runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1 to catch attempts to extract hidden reasoning, with a false positive rate Anthropic puts below 0.1%. Third, since September 24, Anthropic has resumed charging for requests its safeguards block before Claude responds, in the specific areas, including distillation, where false positives stay under 0.1%. Anthropic says plainly that it hasn't fully met its goal of leaving legitimate users unaffected: some developers had to update their integrations, and a small share of benign requests get blocked and billed.
Why it matters
For most teams the direct cost is small: under 0.1% of requests in a narrow set of categories. But it's a new kind of charge, a request billed with nothing returned, and easy to miss if you only reconcile spend against successful responses. If your integrations edit earlier turns of a conversation before resending them, check whether accounts created on or after August 31 behave differently from your older ones. More broadly, Anthropic is pushing other providers to follow, arguing that "Defenses are expensive, and illicit distillers are still paying customers." Expect more provider-side controls like this, and track blocked-but-billed requests as their own line item.