Anthropic Says It Cut Claude Data Harvesting by Up to 99%. Developers May Notice

Anthropic says new defenses have cut the amount of Claude data harvested by "distillers" by around 90 to 99 percent. Distillers are rival developers that copy a model's abilities by training on its outputs. The centrepiece is a feature called "preserved thinking," built into Claude Fable 5.1 and Claude Opus 5.5.

For most people using Claude, nothing changes. But developers who edit conversation history between API calls may start seeing errors, or paying for extra output tokens, on newer accounts.

Based on Anthropic's October 12 research post and its preserved thinking documentation, plus coverage from International Business Times and The Hacker News, checked October 13, 2026. The reduction figures are Anthropic's own estimates. No outside party has verified them.

What "data harvesting" means here

Anthropic defines distillation attacks as "covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another, without the authorization of the original model's developers." Attackers send millions of requests, often through networks of fake accounts, then train a smaller model on Claude's answers.

The most valuable data, Anthropic says, is Claude's reasoning: "the thinking process that Claude writes out before it responds." That is why its defenses "focus almost entirely on making Claude's reasoning harder for distillers to access."

Its own test shows why. A pretrained Claude model trained on full reasoning transcripts from Claude Opus 4.8 scored 80.4% on the SWE-bench Verified coding benchmark. Trained only on summarised reasoning, it scored 71.8%. On our arithmetic, hiding the full reasoning cost the copied model 8.6 percentage points.

How preserved thinking works

When Claude reasons through a problem, the API returns that reasoning in "thinking blocks," each carrying a signature the API can check. Developers send those blocks back on later turns so the model can build on its earlier reasoning. Attackers abused this. Anthropic says they "moved protected reasoning blocks between conversations" to trick Claude into revealing its unsummarised reasoning.

According to Anthropic's documentation, starting with Claude Fable 5.1 the API now checks two things whenever a thinking block comes back:

• Which model made it. Each model reads only its own blocks and those of a fixed set of other models. For example, Opus 5.5 cannot read blocks from Fable 5.1. Unreadable blocks are dropped without an error.
• Whether anything before it changed. The system prompt, the tools list and every earlier message form the block's "prefix." If you edit any of them, that block and every later thinking block become invalid.

Thinking blocks from Claude Sonnet 5.5 and Claude Haiku 5.5 are also tied to the account that produced them. The research post says this makes Sonnet 5.5 reasoning "accessible only to the organization whose request produced the transcript."

The numbers Anthropic is claiming

• 90 to 99% less data harvested by distillers, according to "early evidence."
• 10 to 100 times fewer reasoning tokens extracted on Anthropic's own platform once its new classifier was in place. A tenfold drop equals 90% and a hundredfold drop equals 99%, so the two figures describe the same range.
• Tens of thousands of accounts banned, "often in less than two hours" after a campaign starts.
• Below 0.1%: the classifier's stated false positive rate. It runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1.

Anthropic also says that since September 24 it has "resumed charging for requests that are blocked by our safeguards before Claude responds" in areas such as distillation.

The post names two Chinese companies. It says Zhipu "distilled the cyber capabilities of leading US models" while building GLM-5.3. It also says requests to Moonshot's Kimi models "were secretly forwarded to Claude." This follows Anthropic's February report, which accused DeepSeek, Moonshot and MiniMax of generating "over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts." In September, The Hacker News reported that Anthropic had named seven China-based labs.

What developers need to do

The docs are clear on who is affected: "Nothing changes for you if Claude Code, claude.ai, Claude Managed Agents, or the Claude Agent SDK builds your requests." The same applies if your code keeps the system prompt and tools fixed and only ever adds new messages.

The check is enforced by default for accounts created on or after August 31, 2026 (00:00 UTC). Older accounts are enforced only when they opt in. Check your integration if it does any of these between turns:

• Rebuilds the system prompt, for example to insert today's date
• Trims old tool results or summarises old turns itself
• Adds, removes or edits tools mid-session
• Removes thinking blocks from the middle of the history

On a newer account, an edited history returns a 400 error by default. You can set prefix_mismatch_behavior to "drop_block" instead, but that has a cost. In Anthropic's testing, dropping thinking once per session raised output tokens by 20.1% at max effort, and dropping it every turn raised them by 67.1%. If your users run your tool with their own API keys, the docs warn that those on newer accounts "get the 400 error before you do."

Does this change what reasoning you can see? Not directly. Anthropic says it already summarises Claude's reasoning before showing it. Preserved thinking controls how earlier reasoning can be reused, not what is displayed.

The catch: Anthropic is marking its own homework

Every figure here comes from Anthropic. The coverage we read repeats its claims without independent data, and includes no response from Zhipu or Moonshot.

Anthropic is also candid about the limits. "We don't yet know how long these gains will last," the post says, adding that "we have yet to see a highly sophisticated and persistent attempt to circumvent them." It admits it has not fully met its goal of leaving legitimate users unaffected: some developers had to update integrations, and benign requests blocked by mistake are now charged.

There is a commercial angle too. Anthropic says it has turned away "trillions of tokens' worth of paying traffic," and it is urging other labs and cloud platforms to adopt similar defenses.

Frequently asked questions

Does preserved thinking affect me if I only use the Claude app?

No. According to Anthropic's docs, nothing changes if claude.ai, Claude Code, Claude Managed Agents or the Claude Agent SDK builds your requests.

My account is older than August 31, 2026. Am I safe?

For now, edits won't cause errors on your key. But anyone using your code with a newer key will hit them. Anthropic suggests sending the thinking-binding-controls-2026-08-01 beta header to see which blocks would fail.

Is distillation always illegal or banned?

No. Anthropic calls distillation "a widely used and legitimate training method." Its objection is to covert, large-scale copying through fraudulent accounts without permission.

If you build on the Claude API, the safest fix is simple: keep the system prompt and tools fixed for each session and only ever add messages to the end. That pattern also helps prompt caching.