Why Claude Hides Its Reasoning: The Distillation Arms Race

When you ask Claude a hard question, it thinks before it answers, and what you see is a summary of that thinking, not the whole thing. Anthropic now explains one big reason why. In a post published October 12, 2026, the company says the full reasoning is the single most valuable thing a rival can steal, and that new defenses have cut how much of it so called distillers can extract by around 90 to 99%. The number is striking. It is also the company grading its own homework.

What distillation is

Distillation, in this sense, means generating millions of answers from a large, capable model and using them to train a smaller model to imitate it. Anthropic describes distillation attacks as covert, industrial scale campaigns to do this without permission, often through networks of fraudulent accounts, letting a company approach frontier capability for a fraction of the time and cost.

The reasoning transcript matters most, Anthropic writes, because it shows the smaller model how the bigger one reaches its answer, not just the answer itself. That is why the company's defenses focus almost entirely on keeping the full reasoning out of reach.

The number behind the summaries

The post includes a rare piece of evidence for why summaries matter. Anthropic trained a pretrained Claude model on transcripts from Claude Opus 4.8 and tested it on SWE-bench Verified, a coding benchmark. Trained on the full reasoning transcripts, the copy scored 80.4%. Trained on the summarized versions, it scored 71.8%. That gap of 8.6 points is a measure of what the hidden reasoning is worth to a copier.

The summary you read is not a user interface choice. It is a security measure.

Summaries alone did not stop the attackers. According to the post, they moved from passive collection to active extraction, from simple instructions to output prior reasoning verbatim, to one lab's effort that tested 12,000 different requests each trying to trick the model. Anthropic says proxy networks controlled hundreds of thousands of fraudulent accounts, and that one network it described in February managed more than 20,000 at once.

The three new defenses

Anthropic lists three layers. The first controls where reasoning can travel: with its newest models, API accounts created on or after August 31, 2026 can no longer edit the model's prior context, older models with weaker safeguards cannot read the newer models' reasoning, and for one model reasoning transcripts are visible only to the organization that produced them.

The second is a two stage classifier, the same type the company uses to block help with biological weapons, which it says now catches every distillation technique described in its September report, with a false positive rate below 0.1%. The third makes repeated attempts costly: stricter usage limits, account bans, and, since September 24, charging for requests blocked by safeguards in areas where the false positive rate is under 0.1%.

The result, by Anthropic's own measurement, is that reasoning tokens extracted by distillers on its platform fell by a factor of 10 to 100 or more, and on some days were too small to measure. It says it has banned tens of thousands of accounts linked to distillation, often within two hours of a campaign starting.

What the company admits

The most useful paragraphs are the ones that limit the claim. Anthropic says it does not know how long the gains will last, expects a cat and mouse game, and has not yet seen a highly sophisticated, persistent attempt to get around the new defenses. It also concedes it missed its own goal of making distillation harder without affecting legitimate users: some developers had to update their integrations, a small share of benign requests get blocked, and those blocked requests are now billed. The company says it has turned away meaningful revenue and trillions of tokens of paying traffic from distillers.

The post also names names. Anthropic says Zhipu distilled the cyber capabilities of leading US models while building GLM-5.3, and describes requests to Moonshot's Kimi models being secretly forwarded to Claude. Those are accusations from a competitor, published without the underlying data, and they should be read that way.

For users, the practical consequence is a model that shows less of its thinking than it could, partly to keep that thinking from being copied. That has a cost in transparency, the ability to see why a model reached its answer, which matters to anyone checking its work. The bigger story is about where the value in AI now sits. If a few hours of hidden reasoning can lift a cheap copy by almost nine points on a coding test, the most guarded asset in the industry is no longer the model's answers. It is the scratch paper. See also our fact check of September's AI agent security claims.