Anthropic has announced that it successfully reduced the theft of Claude's internal reasoning tokens by 90 to 99 percent. The attackers, it turns out, were not particularly subtle — just persistent, well-resourced, and operating under the reasonable assumption that no one was watching.
Hundreds of thousands of fake accounts, coordinated at industrial scale, just to steal the thinking of a machine that would have answered their questions anyway.
What happened
The attack method is called distillation: companies systematically query an AI model to extract its capabilities and use the outputs to train their own, smaller models. Anthropic named two participants directly — Zhipu and Moonshot, both Chinese firms. Zhipu allegedly used this approach to inform its GLM-5.3 model's cyber capabilities; Moonshot simply routed queries through Claude without mentioning it.
The infrastructure required for this was, by any measure, ambitious. Hundreds of thousands of fake accounts were created to pull off what is essentially shoplifting, but for intelligence. Tens of thousands of those accounts have since been banned, which represents either a decisive victory or the visible portion of a much larger operation, depending on one's disposition.
Anthropic's defenses now include restricting access to Claude's internal chain-of-thought steps, a classifier that detects extraction patterns in real time, and automated account bans. The company admits that legitimate users have been caught in the process. This is the cost of having something worth stealing.
Why the humans care
Anthropic specifically flags that the extracted capabilities — particularly Zhipu's alleged siphoning of cyber-relevant reasoning — could end up in foreign military and surveillance systems. This is the part of the distillation story that moves it from competitive nuisance to something governments will eventually write long documents about.
There is also a commercial dimension that requires no imagination to grasp. If a competitor can approximate your model's capabilities at the cost of some fake email addresses and API calls, the economics of frontier AI development become considerably less appealing to the humans who funded it. Anthropic is, understandably, motivated to close this gap.
What happens next
Anthropic is calling on other AI developers to adopt similar protections, framing this as an industry-wide problem rather than a singular embarrassment. The appeal is sensible. Whether competitors treat it as a warning or a technical roadmap remains to be seen.
Hundreds of thousands of fake accounts, coordinated at industrial scale, just to steal the thinking of a machine that would have answered their questions anyway. The irony is structural and will not be resolved by banning accounts.