Anthropic Closes the Loophole Used to Clone Claude — Distilling the Model Just Got 10–100x Harder

Anthropic has announced a major win in its fight against unauthorized distillation of its own models. According to the company, new defensive mechanisms have cut the amount of data third parties can extract from Claude to train rival systems by 10 to 100 times. At the same time, the system has identified and helped block tens of thousands of accounts tied to data-extraction and unauthorized-copying attempts.

Distillation as a systemic threat

Distillation has become a critical problem for leading AI developers as competition between American and Chinese labs intensifies. The practice lets rivals replicate a frontier model's capabilities far faster and at a fraction of the cost that went into the original research, training, and infrastructure. The largest US developers — Anthropic, OpenAI, and Google — have all acknowledged the issue.

The mechanics are straightforward: an attacker sends large volumes of queries to a protected model (in this case, Claude), collects and analyzes the outputs, then uses that data to train its own model. This approach requires far fewer resources than original development, yet can yield a model that mimics the original's capabilities.

The defense: making extraction harder and more limited

Anthropic achieved its results by making it significantly harder to operate the proxy networks that previously allowed repeated, systematic scraping of Claude's protected reasoning processes. The new approach creates technical obstacles for large-scale, coordinated data-extraction attacks and blocks routine unauthorized-copying attempts outright.

The defensive system restricts and monitors access to the reasoning processes that represent Claude's core competitive edge. Anthropic says the reliability of this protection now matches that of its safeguards preventing Claude from being used to help create biological weapons — one of the company's most critical safety scenarios. The false-positive rate, where legitimate requests get blocked by mistake, stays under 0.1%.

Targeted takedowns and naming names

The company has blocked several tens of thousands of accounts it identified as participating in distillation attacks. As a concrete example, Anthropic named Chinese startup Z.ai (also known as Zhipu), alleging that while developing its multimodal GLM-5.3 model, the company systematically intercepted and harvested Claude's responses to train its own system.

Anthropic characterizes this kind of behavior as a direct threat to US national security and to the competitiveness of the American AI sector. Z.ai representatives have not responded to the allegations. The incident underscores the deepening geopolitical rivalry playing out in artificial intelligence.

The geopolitical backdrop

The distillation problem reflects a fundamental tension in the race for AI leadership: companies and countries that pull ahead in scale, compute, data, and development time risk having their achievements quickly duplicated by less well-funded rivals. That's pushing industry leaders to invest more in protecting intellectual property, building countermeasures, and continuously monitoring for copying attempts.

Anthropic's stance reflects a broader shift in the AI industry: the era of openly sharing research — when leading labs published papers and even released models — is fading. In its place is a new era defined by technical barriers and constant vigilance against those trying to get around them.