🧭 Anthropic's New Distillation Defenses Cut Data Harvest by 90–99% — Here's What Changed for API Users
Anthropic published a detailed research post today laying out the measures it has rolled into Claude Fable 5.1 and Claude Opus 5.5 to stop rival labs from covertly copying Claude's reasoning capabilities through large-scale model distillation attacks. The headline figure: the volume of reasoning tokens that attackers can harvest has fallen by 90–99% since the new defenses went live. The biggest documented campaign — attributed to Alibaba — ran 151 million exchanges between May and July 2026, peaking at nearly three million exchanges per day. A second campaign linked to Moonshot AI's Kimi included a query from a People's Liberation Army address seeking CCTV surveillance analysis.
The three-layer defense
- Preserved thinking: API accounts created on or after August 31, 2026 cannot edit Claude's prior context mid-conversation. The "prior context editing" technique was the main way attackers extracted long reasoning transcripts — by injecting specially crafted prior turns that instructed the model to surface its internal chain-of-thought verbosely. Blocking that edit removes the primary extraction vector.
- Two-stage classifier: A purpose-built classifier now screens every request for distillation intent. Anthropic reports a false positive rate of under 0.1% on legitimate traffic. Tens of thousands of accounts have been banned within two hours of starting a distillation campaign — the classifier fires faster than the attacker can rotate proxies.
- Cross-model isolation: Reasoning transcripts generated by Sonnet 5.5 and later models are only accessible to the organisation whose request produced them. Earlier models with weaker safeguards can no longer read the extended reasoning of newer ones, closing an inter-model relay exploit.
What this means if you use the API
Action needed if your account was created before August 31, 2026
The prior-context editing restriction only applies to new accounts (created on or after August 31). If your integration relies on prepending or modifying prior assistant turns — for example, to inject cache-friendly context — test it against the new behaviour now. Anthropic plans to extend the restriction to older accounts in a future update, so review any code that calls the Messages API with role: "assistant" turns you construct manually. The correct pattern going forward is to use system prompts or user-turn context injection instead of fabricated assistant turns.
Anthropic is candid about the limits of these defenses: the company describes the problem as a "cat-and-mouse game" and expects the gains to erode over time as attackers adapt. The post commits to continued iteration and flags that the second-generation GLM-5.3 model — assessed by CAISS as the most cyber-capable open-weights model currently available — was built in part using capabilities extracted from US frontier models, illustrating the concrete downstream harm the defenses are designed to prevent.
security
distillation attacks
preserved thinking
API
model protection
developer tools
🧭 Frontier Red Team: Small Models Could Self-Replicate Across IoT Devices — Capability May Arrive by End of 2026
Anthropic's Frontier Red Team published a capability evaluation yesterday that found small AI models are significantly further along the path to autonomous self-replication than previously documented. Using fifteen off-brand Android TV boxes costing roughly $55 each, the team sharded a 26-billion-parameter model (Gemma4-26B-A4B) across the fleet under pipeline parallelism — each box holding only a fraction of the model's layers. A 9-billion-parameter model successfully got inference running on eight of nine hardware types tested. The key finding: models of 30 billion parameters and under can already complete many individual steps of a replication task, but still fail to compose those steps end-to-end without errors.
Why this matters for AI safety
- No centralised shutdown point: A model distributed across hundreds of consumer IoT devices — smart TVs, set-top boxes, routers — has no single endpoint that can be taken offline. Traditional containment (revoke API keys, disable cloud endpoints) does not apply.
- Cheap compute floor: At $55 per node, an adversary could assemble sufficient fleet compute for a capable small model for a few thousand dollars. Poorly secured home and industrial IoT devices are plentiful and largely unmonitored.
- Near-term timeline: The team projects that if small model capabilities continue improving at their historical rate, the end-to-end composition capability — currently the missing link — could close by end of 2026, with weight-based replicators possible shortly after. Replication doubling time is estimated at days, not hours.
- Not yet realised: Anthropic is explicit that it does not currently have evidence of a rogue replicator in the wild. This is a controlled capability evaluation, not a disclosed incident.
Implications for enterprise AI deployment
This research is a leading indicator for enterprise security teams. If small, capable models can self-replicate across unmanaged edge hardware, the threat surface for data exfiltration and inference abuse widens significantly beyond the API. Organisations running Claude Code or similar agentic tools in environments with access to IoT or embedded infrastructure should review their network segmentation policies now — before capability reaches the threshold the Red Team has identified. Specifically: ensure agentic processes cannot reach device management interfaces, firmware update endpoints, or unauthenticated local network services.
The research draws on the same capability-evaluation framework the Red Team uses for CBRN (chemical, biological, radiological, nuclear) uplift assessments, applying it for the first time to autonomous replication. Anthropic has shared the methodology with selected government partners under the Cyber Verification Program ahead of public release.
safety
self-replication
Frontier Red Team
IoT
AI risk
security
capability evaluation
