Anthropic cuts Claude reasoning token theft by up to 99%

By Splitfeed EditorialLast updated Oct 13, 2026, 11:10 UTC

On October 13, 2026, Anthropic announced that new technical defenses had reduced the extraction of Claude's internal reasoning tokens by between 90 and 99 percent. The company attributed the attacks to Chinese AI firms Zhipu and Moonshot, describing the activity as industrial-scale distillation, and said it had banned tens of thousands of accounts connected to the harvesting operation. The attacks targeted not just Claude's standard outputs but its internal chain-of-thought reasoning steps, which are especially valuable because they capture the step-by-step logic that makes extended-thinking models competitive.

Distillation attacks are a form of model theft in which a competitor feeds large volumes of queries to a target model, collects the outputs including reasoning traces, and uses that data to train a cheaper imitation. The practice lowers the cost of building a frontier-capable model significantly, since the attacker skips much of the expensive pretraining and alignment work. What makes this announcement notable is the scale Anthropic is describing and the directness of naming specific companies in a geopolitically sensitive context. Whether Zhipu and Moonshot were acting independently, with the knowledge of their investors, or in any coordinated way is not something Anthropic has publicly established, and that attribution carries real diplomatic and legal weight.

None of the three camps had published reactions by the time this story was filed, so what follows reflects typical positions rather than anything anyone said. The Pro-AI camp would likely frame Anthropic's response as evidence that the industry can police itself, pointing to the technical success in cutting extraction rates as proof that safety-conscious labs can protect proprietary research without government intervention. The Anti-AI camp would probably focus on the scale of the attack itself, arguing that the episode illustrates how opaque and exploitable large AI systems are, and that a 90 to 99 percent reduction still leaves a residual channel open. The Middle Ground camp would typically call for clearer regulatory frameworks around model intellectual property and cross-border enforcement, treating this as a case where voluntary countermeasures are necessary but not sufficient.

The details most worth watching are whether Anthropic or affected regulators pursue any formal legal action against the named companies, and whether Zhipu or Moonshot issue public responses disputing the attribution. Any enforcement filing, government inquiry, or corporate rebuttal would substantially clarify how much of the 90 to 99 percent figure represents a durable technical fix versus a temporary countermeasure that determined actors could route around.