BuildNot yet confirmed elsewhere1 publisher2 min readPublished
Anthropic says its mitigations have reduced the effectiveness of Claude distillation attacks, though attackers keep adapting
Anthropic says detection, access controls and intelligence sharing are blunting Claude distillation campaigns that ran past 16 million exchanges. The report is a vendor's account of its own defenses, relayed by dev.to, and it frames abuse handling as part of vendor security.
The Engineer · Build desk
Key figures: Anthropic said the activity involved more than 16 million exchanges across roughly 24,000 accounts, which works out to at least about 667 exchanges per account on average.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Exchanges in the campaigns, per Anthropic, more than | 16,000,000 exchanges | 2 | |
| Accounts used, roughly | 24,000 accounts | 2 | |
| Exchanges per account on average, at least about | 667 exchanges | derived from February campaign volume | 9 |
What happened
- In a February 23, 2026 disclosure, Anthropic attributed the campaigns to DeepSeek, Moonshot AI and MiniMax.
- Anthropic said the exchanges ran through roughly 24,000 accounts, with proxy networks and routing methods designed to evade access controls.
- A September 2026 threat-intelligence report describes continued campaigns attributed to Alibaba, Moonshot and DeepSeek against Opus-class models, some reaching millions of exchanges per day.
- Detection relies on classifiers and behavioral fingerprints that flag prompts and usage patterns associated with harvesting model outputs or reasoning-related material.
- Anthropic has tightened verification on educational, security research and startup programs, which can be abused to obtain fraudulent access.
Why it matters
- decision Vendor questionnaires should ask how a provider describes abuse detection, account security and incident response, alongside model features.
- constraint Customers cannot verify cross-account detection from their side of the API, so diligence runs on what the vendor chooses to publish.
- contradiction The record that supports the disruption claim also shows attackers adapting, so 'meaningful progress' is a statement about a contest that is still running.
- cost Teams that get Claude access through those programs should expect more verification steps before they are cleared.
Per-account controls are the first defense anyone builds. The dev.to summary says those controls may not hold up when an operation distributes its requests over hundreds or thousands of accounts [7]. The "hydra-style" routing Anthropic describes makes the failure concrete: cutting off a single account or infrastructure path will not necessarily end a campaign that is able to move its requests somewhere else [7].
The February numbers show how thin each slice is. Divide the stated exchanges by the stated accounts and the result is at least about 667 exchanges per account [9]. The disclosure says "more than" 16 million, so that is a floor on the average, and an average hides the spread [2]. At that scale we'd expect a per-account limit to have little to grab.
That moves detection up a level, to the campaign. Anthropic says it analyzes coordinated activity to connect behavior across many accounts, including accounts that use proxy networks or distributed routing [5]. The inputs are account relationships, request metadata, IP correlation and coordinated traffic patterns, signals the summary says individual users cannot see [8].
The summary does not include a before-and-after volume, a share of attempts blocked, or a response from the three companies Anthropic named. Until a later report gives volumes over time, we think the defenses described are documented and the reduction is Anthropic's assertion. The attributions in the February disclosure are Anthropic's own [1].
For the buyer, the summary says a company calling a model through an API is not usually responsible for stopping these campaigns, though the provider's ability to detect abuse and respond affects the environment the service runs in [12]. The one thing a customer controls is its own access. The summary recommends official accounts, appropriate authentication and supported API access, and advises against shared or informal arrangements [14]. In our view that advice is cheap, and we'd expect shared credentials to be harder for a provider to tell apart from the account patterns its detection is built to link.
What to watch
- A later Anthropic threat report that gives exchange volumes or blocked share over time, which would turn the progress claim into a measurement.
- Public responses from DeepSeek, Moonshot, MiniMax or Alibaba to Anthropic's attributions.
- Other model providers publishing comparable descriptions of cross-account detection that buyers can set beside Anthropic's.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+15
- Incentives65
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
In a February 23, 2026 disclosure, Anthropic described campaigns it attributed to DeepSeek, Moonshot AI and MiniMax.
- [2]
Anthropic said the activity involved more than 16 million exchanges across roughly 24,000 accounts, using fraudulent accounts, proxy networks and routing methods designed to evade access controls.
ReportedSupportedSource: Anthropic's February 23, 2026 disclosure, as summarized by dev.toView cited source - [3]
Anthropic's September 2026 threat-intelligence report describes continued detection and disruption activity, including campaigns attributed to Alibaba, Moonshot and DeepSeek that targeted Claude's Opus-class models, and says some activity reached millions of exchanges per day.
ReportedSupportedSource: Anthropic's September 2026 threat-intelligence report, as summarized by dev.toView cited source - [4]
Anthropic uses detection systems, including classifiers and behavioral fingerprints, to identify prompts and usage patterns associated with harvesting model outputs or reasoning-related material.
- [5]
Anthropic uses coordinated-activity analysis to connect behavior across many accounts, including accounts that use proxy networks or distributed routing.
- [6]
Anthropic applies tighter verification to high-risk access paths, including educational, security research and startup programs that can be abused to obtain fraudulent access.
- [7]
Account-level abuse controls alone can be insufficient against an operation that spreads requests across hundreds or thousands of accounts; Anthropic's description of 'hydra-style' routing illustrates that blocking one account or infrastructure path does not necessarily stop a campaign that can shift requests elsewhere.
- [8]
Defending against systematic extraction can involve signals that individual users cannot see, such as account relationships, request metadata, IP correlation and coordinated traffic patterns.
- [9]
Anthropic's stated February campaign volume works out to at least about 667 exchanges per account on average.
- [10]
Anthropic says it has made meaningful progress in reducing the effectiveness of illicit distillation attacks against Claude.
ReportedContestedSource: Anthropic, as summarized by dev.to2 sources— create a free account to open themView cited source - [11]
The public disclosures support Anthropic's claim that its mitigations have disrupted campaigns, while also making clear that attackers continue to adapt.
- [12]
A company calling a model through an API is not usually responsible for stopping industrial-scale distillation campaigns, but the provider's ability to detect abuse, protect access routes and respond to coordinated threats affects the environment in which the service operates.
- [13]
Teams adopting AI should review how a vendor describes abuse detection, account security and incident response, not just model features.
- [14]
Teams should use official accounts, appropriate authentication and supported API access rather than shared or informal access arrangements.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toAnthropic Says Its Defenses Are Reducing Claude Distillation Attack Effectiveness
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.