Less material for copying, the company says
Anthropic announced on October 12 that its new defenses against unauthorized distillation of Claude reduced data collected by attackers by around 90% to 99%. It describes preliminary evidence, not a guarantee that every copying attempt will fail. The focus is the model’s reasoning data, which can help train another model to imitate its capabilities, rather than only the final answer users see.
Distillation transfers capabilities between models through their outputs. The technique itself is not synonymous with an attack: authorization, usage terms and access methods matter. Anthropic is addressing systematic unauthorized extraction campaigns. For nondevelopers, the distinction is straightforward: using an answer to do work and using a service to copy its capabilities at industrial scale are not necessarily the same activity or governed by the same terms.
The gap between answers and reasoning explains the protection’s focus. Claude’s documentation says text displayed in a thinking block is a summary, not the full internal transcript. An explanation-like field therefore does not expose everything preceding the answer. Users seeking understanding can request a brief explanation, evidence or an account of actions without demanding a complete reconstruction of protected internal reasoning.
Anthropic describes restrictions on moving reasoning, classifiers for extraction attempts and limits on accounts that persist. It reports a classifier false-positive rate below 0.1%. That is also a company measurement. It does not mean no harmless requests will be blocked or that an application with different tasks and wording will experience precisely that error rate.
Editing conversation history can change the outcome
One component is preserved thinking, which already exists for certain models and accounts. Claude’s help center says it applies to API accounts created from August 31, 2026, using Claude Fable 5.1, Claude Opus 5.5, Claude Sonnet 5.5 or Claude Haiku 5.5. The current publication explains defenses; it does not relaunch these models or impose a simultaneous blanket change on all older accounts.
The mechanism checks that a thinking block returns with the context that produced it: earlier messages, system instructions and tools. Editing that context can trigger an error. In the documented non-strict mode, requests can continue after affected thinking blocks are removed. Continuing with the same previous material and continuing without some of it are meaningfully different, even when the visible conversation looks similar.
An integration that shortens history, changes tools mid-conversation or inserts instructions into earlier sections may consequently need adjustment. Anthropic documents context compaction and tool-change options that avoid editing history in the same way. Their availability should not be assumed across every platform and mode: implementation must follow the actual environment’s documentation, not expectations copied from another interface.
Claude.ai, Claude Code and Claude Cowork users do not need to manage thinking blocks themselves, the help center says. The work primarily concerns teams maintaining their own integrations. A single-question test is insufficient for such teams: test conversation sequences, tool use and context compaction, because a problem may emerge only after an intermediate change, rather than on the first request.
A refusal is not always an error or free
API documentation says a classifier refusal can arrive as a normal HTTP response with a refusal stop reason. That differs from a thinking-context validation error. An application must distinguish them to explain the outcome and handle it appropriately. A refusal does not establish misuse, and should not automatically be treated as a network failure to fix through indiscriminate retries.
There is a budget implication too. Anthropic says it resumed charging on September 24 for requests blocked before output in certain categories, including reasoning extraction. This explains an existing policy, not a new October 12 price list. Documentation distinguishes categories and pre-output blocks from refusals after partial output, so neither “all refused requests are free” nor “all refusals are billed alike” is a sound rule.
Operationally, track successful answers, refusals and integration errors separately, and inspect reported usage before setting retry rules. A repeatedly blocked legitimate request calls for diagnosis, not merely more attempts. A request identifier can help support investigate. Users can receive a clear account of what worked and what needs attention without unnecessary internal system details in the interface.
The meaning of below 0.1% also depends on the question. An aggregate error rate does not guarantee the same experience in every language and field. Product teams should test representative user requests and check whether users still reach their intended result. This is practical evaluation advice, not a claim that the company established uniform quality across every application or user population.
Early success does not end the contest
Anthropic itself says it does not know how long the gains will last and expects attackers to keep seeking bypasses. It also says it has not yet seen a particularly sophisticated, persistent attempt against the full new protections. The reduction should therefore be read as the company’s assessment of its system, not independent proof of a permanent solution or equivalent protection for every other model.
The case highlights the difference between protecting model capabilities and a general promise of user safety. Less reasoning extraction does not prove every answer correct, every agent predictable or all business data handled according to an organization’s requirements. Each question needs its own assessment. Combining them under “security” can produce more confidence than these specific figures support and lead to poorly matched controls.
In Israel too, the direct implication concerns integration design, not new availability or a new Hebrew-quality commitment. Teams working in Hebrew should test their own requests and workflows in that language. A large percentage in a headline alone does not require changing a business process; teams need to determine whether the mechanism applies to their account and model and how it fits the running system.
The development is that protection against capability copying increasingly shapes how AI conversations are retained, checked and billed. Ordinary users may never manage this directly; developers must treat it as product behavior. The eventual measure is not only how much attacker data was blocked, but whether authorized users can still complete their work consistently, understandably and at a cost they can plan.