Protected Claude reasoning now has tighter account and model boundaries, and some requests blocked before Claude responds still incur charges. These changes are part of defenses that Anthropic says have reduced the data harvested by unauthorized distillers by around 90% to 99%.
The company’s October 12 distillation-defense report describes restrictions on reasoning transcripts, extraction-detection classifiers, stricter usage limits, and account bans. Anthropic separately reports that exposed reasoning tokens fell by a factor of 10 to 100 after it introduced its classifier.
These are Anthropic’s measurements, not independently verified results. For Claude API customers, the immediate concerns are integration compatibility and billing: protected reasoning cannot move as freely between accounts and models, some integrations need changes, and a blocked request does not necessarily mean an unbilled request.
The Target Is Claude’s Reasoning, Not Just Its Answers
Model distillation trains a model using outputs from another model. Anthropic describes the campaigns it is targeting as unauthorized, industrial-scale efforts to reproduce Claude’s capabilities, often through networks of fraudulent accounts. Those descriptions and the associated threat assessments are the company’s claims.
Its defenses focus primarily on reasoning transcripts: the intermediate text Claude generates before delivering an answer. Anthropic argues that these transcripts give distillers more useful training material than final answers alone because they contain the steps used to reach an answer.
To support that distinction, the company reports an experiment in which a pretrained Claude model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified. Training on transcripts containing summarized reasoning produced a score of 71.8%, an 8.6-percentage-point difference in Anthropic’s reported coding-benchmark test.
The experiment supports the value of reasoning in that particular training setup. It does not measure every competitor’s dependence on Claude. It also measures downstream coding performance, whereas the headline 90% to 99% reduction concerns harvested data.
Anthropic initially tried summarizing reasoning before exposing it to users. It says distillers subsequently shifted toward active extraction attempts designed to obtain the unsummarized material. The new controls address both those requests and the infrastructure used to repeat them.
