Anthropic Cut Claude Reasoning Token Theft by Up to 99 Percent

Anthropic says it has cut the theft of Claude's internal reasoning tokens by 90 to 99 percent. The company disclosed the figures as part of its response to what it describes as industrial-scale distillation attacks, and it linked the campaigns to the Chinese companies Zhipu and Moonshot.

The scale of enforcement is large. Anthropic says it has already banned tens of thousands of accounts tied to the abuse.

The disclosure lands at the center of one of the most contested questions in the AI industry: who controls the value of a frontier model's outputs, and what happens when competitors systematically harvest them.

What did Anthropic actually announce?

The company reported two concrete results. First, the extraction of Claude's internal reasoning tokens — the hidden chain-of-thought material the model generates before producing an answer — has fallen by 90 to 99 percent following its countermeasures. Second, the enforcement effort has removed tens of thousands of accounts engaged in the practice.

Anthropic attributed the large-scale distillation campaigns to Zhipu and Moonshot, two of China's most prominent AI companies. Both firms develop and market their own foundation models and compete in the same general market as Claude, OpenAI's GPT family, and Google's Gemini.

The attacks fall under the category of model distillation: using a target model's outputs to train a competing model at a fraction of the cost of developing one from scratch.

Why do reasoning tokens matter so much?

Reasoning models such as Claude generate internal reasoning tokens before they answer. These tokens represent the model's step-by-step working — the part of its behavior that is normally hidden from the user and exposed only in summarized or truncated form.

That material is valuable precisely because it is hard to produce. Training a frontier reasoning model requires enormous compute, specialized data, and months of engineering. Harvesting reasoning traces from an existing model offers a shortcut, and Anthropic's terms of service prohibit building competing models from its outputs.

The 90-to-99-percent reduction figure is therefore the operative number in the announcement. It measures how much of that leakage Anthropic says it has closed off.

The figure is a range, not a single result, and Anthropic itself is the source of the measurement. The company has an obvious commercial interest in demonstrating that its defenses hold.

What does this mean for the AI market?

The stakes are economic as well as technical. Frontier model developers spend billions on training runs, and the subscription and API revenue that funds them depends on customers paying for access rather than copying capability wholesale.

Distillation threatens that model. A competitor that siphons outputs at scale acquires much of the training signal without the cost. For a company like Anthropic, which has positioned Claude's reasoning ability as a differentiator, the internal reasoning tokens are among the most sensitive assets it holds.

The attribution to Zhipu and Moonshot raises the commercial stakes further. This is not a story about individual scrapers or academic researchers testing model limits. It concerns named corporate actors in a market where Chinese and American AI firms compete directly for customers and benchmark standing.

Tens of thousands of banned accounts indicate the operations were automated and distributed, not the work of a handful of users. Enforcement at that scale requires detection systems that identify distillation patterns across large volumes of API traffic.

Why now?

Anthropic published the results as distillation has moved from a niche research technique to a recognized industrial practice. Model providers now treat output security as part of core infrastructure, alongside abuse filtering and content moderation.

The company's decision to name Zhipu and Moonshot is itself notable. Providers have often described such abuse in general terms. Public attribution puts diplomatic and commercial pressure on the named firms and sets a precedent for how the industry handles cross-border model theft.

It also gives enterprise customers a data point: Anthropic claims its defenses reduced the most damaging form of extraction by up to 99 percent.

What comes next?

The number to watch is whether the 90-to-99-percent reduction holds. Distillation techniques evolve, and attackers adapt to detection. Anthropic has committed resources to the fight and says the account bans are ongoing, but the company has framed the results as progress in a continuing contest rather than a solved problem.