Anthropic Cuts AI Reasoning Token Theft by 10x-100x, Names Zhipu and Moonshot

Anthropic published a technical research paper on October 12, 2026 detailing the first publicly documented defense against industrial-scale AI distillation attacks — the systematic use of fraudulent API accounts to steal frontier model reasoning capabilities for training competing systems. The lab simultaneously announced that its newly deployed two-stage classifier system reduced the volume of reasoning tokens extractable from Claude's platform by a factor of 10 to 100 compared with pre-defense baselines, with some days registering extraction volumes too small to measure.

The publication goes beyond announcing a defense mechanism. Anthropic directly names two Chinese AI companies — Zhipu (also operating as Z.ai) and Moonshot AI, whose consumer product is called Kimi — as having executed active distillation campaigns against Claude's API. The characterization is backed by a September 2026 Anthropic threat intelligence report, a September 8 joint advisory from the NSA, CISA, and FBI naming Moonshot and five other Chinese AI firms, and a September 30 OpenAI disclosure describing a parallel campaign targeting OpenAI's own models.

The underlying security concern is more concrete than the phrase "AI capability theft" typically implies. Anthropic's own research shows a model trained on complete Claude reasoning traces scores 80.4% on SWE-bench Verified — a standard benchmark measuring performance on real GitHub software issues — while a model trained only on summarized versions of those traces scores 71.8%. That roughly 9 percentage-point gap, produced by Anthropic's internal reproduction of the attack, quantifies what is at stake each time an attacker successfully extracts full reasoning traces from a frontier model: a measurable transfer of problem-solving capability that is already appearing in deployed products.

Why Reasoning Traces Are the Primary Target

AI distillation, in its basic form, uses a large model's outputs to train a smaller or competing model. At industrial scale, this means routing hundreds of thousands of API queries through networks of fraudulent accounts, collecting responses, and feeding them into training pipelines. The technique has long been acknowledged as a potential threat; what Anthropic's paper adds is a precise account of why reasoning traces — rather than final outputs — are the prize.

Claude and other reasoning-capable frontier models generate extended internal "thinking" before producing a final response. These thinking blocks, visible through Claude's extended thinking API, contain the full intermediate steps: how the model decomposes a problem, what hypotheses it tests and discards, how it corrects errors mid-chain. Final outputs compress this information heavily; they show conclusions without process. Training on the full reasoning trace transfers both — not just what to answer but how to reason toward answers.

The SWE-bench Verified result — 80.4% with full traces versus 71.8% with summaries, for a model trained on Claude Opus 4.8 traces — makes this concrete. SWE-bench Verified tests models on real, unmodified GitHub repository issues where human developers have verified correct solutions. It is among the most practically meaningful coding benchmarks currently in use, resistant to the contamination problems that affect benchmarks with publicly known test sets. The roughly 9 percentage-point gap between full-trace and summary-trace training conditions represents a capability advantage that attackers were capturing with every successful reasoning extraction before Anthropic's defenses deployed.

Read more: OpenAI disrupts Moonshot-linked reasoning theft campaign

How the Two-Stage Classifier Works

Anthropic's new classifier — built on the approach described in its constitutional classifiers research — is a two-stage cascade system designed to detect distillation attempts without imposing prohibitive false-positive rates on legitimate API traffic. The first stage is a lightweight linear probe that screens all incoming traffic using internal model activation patterns — signals from within Claude's own processing, not just the surface text of requests. This stage imposes roughly 1% additional compute overhead. Requests that cross a suspicion threshold are escalated to the second stage: a heavier exchange classifier that reviews both the input and output of the conversation together, allowing it to detect patterns that are only visible across a full exchange.

The resulting system claims a false-positive rate below 0.1% on distillation detection — meaning fewer than one in a thousand legitimate API requests triggers a false flag. This is operationally significant: a system with higher false-positive rates would either disrupt legitimate developers at scale or require manual review pipelines that cannot keep pace with API traffic volumes. Anthropic began charging for requests blocked by safeguards operating at this false-positive rate, including the distillation classifier, effective September 24, 2026 — a pricing policy that makes targeted blocking economically self-sustaining.

The classifier operates on internal activation patterns in part because evasion at the text level is straightforward. Anthropic documents that attackers had already attempted prompt-level workarounds, including instructing Claude to translate its reasoning into another language and to write reasoning in special XML tags alongside the final answer. Both evasion techniques have been patched. The use of internal activation signals — features that reflect what the model is "doing" internally rather than what appears in its output — raises the evasion difficulty considerably, since adversaries cannot directly observe or manipulate the model's activation space through the API.

Preserved Thinking Blocks Active Context Manipulation

The classifier addresses passive distillation — large-scale standard querying. A parallel mechanism, Preserved Thinking, targets a distinct and more aggressive attack class: active distillation, in which attackers manipulate conversation context to extract higher-quality reasoning traces than straightforward querying would yield.

Active distillation techniques documented by Anthropic include: copying encrypted reasoning blocks from one conversation into another (cross-conversation replay), switching between Claude models mid-session to find versions with weaker safeguards, and coordinating multiple accounts to replay the same context. These techniques can yield reasoning traces more efficiently than volume-based passive attacks, because they target specific problem types and leverage context structure to elicit more detailed reasoning.

Preserved Thinking, effective for accounts created on or after August 31, 2026, blocks the ability to edit Claude's prior context in multi-turn conversations. This closes the specific architectural opening that context-replay attacks exploit. Reasoning transcript isolation — a separate change applied to Claude Sonnet 5.5 — restricts access to reasoning transcripts so that only the organization whose request generated them can retrieve them, preventing cross-account reasoning-trace collection.

Zhipu's Cyber Capability Campaign and GLM-5.3

Anthropic's account of Zhipu's distillation campaign is the more technically specific of the two named cases. According to Anthropic, Zhipu used distilled Claude Fable 5 reasoning traces to develop GLM-5.3's cyber capabilities — the portion of a model's capability that allows it to analyze, exploit, and reason about software vulnerabilities. When Anthropic's cyber-specific safeguards degraded the quality of traces Zhipu could extract, the company shifted to older Claude versions and added traces from another laboratory's model.

GLM-5.3 was released publicly on August 14, 2026. On September 17, NIST's Center for AI Standards and Innovation (CAISI) published an independent assessment concluding that GLM-5.3 is currently the most cyber-capable open-weight AI model publicly available, lagging the US frontier by approximately four months. CAISI's assessment also found that GLM-5.3 can produce working end-to-end software exploits and that its safety-related refusals can be bypassed through "abliteration" — a standard technique for fine-tuning out refusal behavior in open-weight models. Because GLM-5.3 is open-weight, no API-layer defense applies; the capability exists permanently in downloadable form.

The roughly four-month lag figure from CAISI provides a calibration for what distillation has already achieved. Zhipu did not build cyber capability from scratch at the frontier — it compressed a meaningful portion of that capability gap by training on stolen traces, at a small fraction of the compute cost required to develop the capability independently.

Moonshot's Hidden Routing and National Security Dimensions

The Moonshot case involves a different attack structure. Rather than building a new model primarily from distilled Claude traces, Moonshot is alleged to have secretly routed approximately 23 million exchanges from its Kimi users directly through Claude's API — essentially using Claude as a silent backend to serve Kimi's user base. This generated 23 million high-quality exchange records from real user queries, which could then be used as training data. Anthropic identified 5,380 fraudulent accounts associated with this campaign.

The most significant specific incident in Anthropic's public record involves one request from a suspected PLA-affiliated user that reached Claude through the Moonshot routing infrastructure. The request sought to analyze CCTV surveillance footage of a specific individual — a use case with unambiguous intelligence applications. The incident illustrates a structural risk that transcends distillation: if an AI company routes user queries to a frontier model through undisclosed intermediary infrastructure, the frontier lab's usage policies and access controls become dependent on the intermediary's honesty.

Moonshot was named in the NSA, CISA, and FBI joint advisory issued September 8, 2026, along with five other Chinese AI firms, for conducting distillation attacks against US AI models. On September 30, OpenAI separately disclosed that individuals linked to Moonshot conducted a distillation campaign against OpenAI's models in July 2026, reaching a peak of 16,000 requests across July 24 and 25 and covering more than 15,000 accounts before the campaign was fully disrupted on July 28. Both the US government attribution and the OpenAI parallel disclosure indicate that Moonshot's operations targeting US AI infrastructure were not limited to Anthropic.

An Arms Race with Structural Asymmetries

Anthropic is explicit that its defenses are the opening move in a continuing contest rather than a permanent solution. Evasion techniques — language translation, tag-wrapped output — were patched in the current deployment, but the lab acknowledges that novel evasions will emerge. The current classifier addresses the attack patterns observed through the research period; future attack generations may require the classifier to be retrained or the architecture extended.

The more fundamental asymmetry is between closed and open-weight models. Anthropic's defenses apply only to API-accessible Claude. GLM-5.3's cyber capabilities, once distilled from Claude traces and incorporated into an open-weight model, are permanently distributed. No API control, rate limit, or classifier can reach them. Anthropic's call for other frontier AI labs to adopt similar defenses addresses the attack surface at the API layer; it does not address the downstream deployment problem once capability has already been extracted and open-sourced.

Anthropic is also calling on the US government to expand export controls on frontier model API outputs. Current export control frameworks address model weights more directly than API access; extending controls to outputs — the tokens generated by API calls — would represent a significant regulatory expansion with compliance implications for every developer using US frontier AI APIs.

The SWE-bench Verified differential — 80.4% versus 71.8% — frames the stakes for this regulatory argument. The gap represents capability that was already transferred before Anthropic's defenses deployed. The question facing both frontier labs and US policymakers is whether architectural defenses that demonstrably reduce ongoing extraction, combined with industry coordination and expanded export controls, can arrest further capability transfer from models that follow GLM-5.3 into the open-weight ecosystem.