Anthropic's research page, published October 12, 2026, states that its new distillation defenses cut the reasoning tokens extractable from Claude by 90 to 99 percent. The spec table below carries the figures that page reports. What the table does not prove is whether those reductions survive contact with a distiller who has not yet been caught, or whether the 10-to-100-fold drop in extracted reasoning holds once the current wave of patched techniques exhausts itself.

A two-stage classifier trained on transcripts of actual extraction attempts, paired with a feature Anthropic calls preserved thinking, which locks prior context on API accounts created after August 31, 2026. The classifier runs on Claude Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. Its false positive rate sits below 0.1 percent. The page does not say how long the reduction has held, or whether it degrades as distillers rotate through new prompt structures. One lab tested 12,000 requests, each seeking to trick Claude in a different way, before the classifier was deployed. The 12,000-request test predates the classifier; the page gives no figure for how many of those prompts it now blocks.

The page names two specific campaigns. Zhipu distilled cyber capabilities from leading US models during GLM-5.3 development, then switched to an older Claude model after Anthropic's cyber safeguards degraded its attacks. Moonshot's Kimi models forwarded requests to Claude, including one from a user Anthropic believes was affiliated with China's People's Liberation Army, seeking CCTV surveillance analysis of a specific individual. The US Center for Advancing Innovation and Standards for Super Intelligence assessed GLM-5.3 as the most cyber-capable open-weights model released to date. Anthropic's own research found its safeguards can be bypassed and that the model will develop security exploits end-to-end. Proxy networks controlling hundreds of thousands of fraudulent accounts, one managing more than 20,000 at a time, fed these campaigns.

Die Brief reads the 90-to-99 percent figure as a ceiling, not a floor. Every technique in Anthropic's September report is now caught by the classifier, but the page concedes it has not yet seen a highly sophisticated, persistent attempt to circumvent the new system. The constraint falls on the distiller, not the buyer: legitimate users face updated integrations, a sub-0.1 percent chance of a blocked request, and a new charge for those blocked calls beginning September 24. The trade is small for a developer running normal workloads and large for a lab trying to replicate a frontier model at a fraction of the cost. Anthropic has turned away meaningful revenue and trillions of tokens of paying traffic, a cost it absorbs rather than passes through.

What the page leaves unmeasured is the total revenue turned away, the exact number of accounts banned, and the duration over which the 10-to-100-fold reduction has been stable. Anthropic says it does not yet know how long these gains will last, and that distillation will remain a cat-and-mouse game requiring continued iteration.

The 90-to-99 percent figure is a ceiling measured against known techniques, not a guarantee against novel ones. The buyer pays a sub-0.1 percent tax in blocked requests and updated integrations; the distiller pays an arms-race cost that Anthropic absorbs as lost revenue.

The page does not state the total revenue turned away, the exact number of accounts banned, or how long the 10-to-100-fold reduction has held.

The two-stage classifier plus preserved thinking raises the marginal cost of each extraction attempt from a single API call to a multi-account, multi-model evasion loop. The <0.1% false-positive rate means the tax on legitimate traffic is negligible, but the 10-to-100x reduction is measured against the specific techniques in the September report, not against an open-ended adversarial search. The constraint is asymmetric: a distiller must outpace a classifier that patches within hours, while a legitimate user only updates an integration once.