Distillation was a sales channel
TL;DR [show]
On October 12, 2026 Anthropic said it had turned away meaningful revenue and trillions of tokens of paying traffic from distillers, labs that train cheaper models on Claude's outputs, conceding that illicit distillers are still paying customers. Its October 26 IPO filing puts revenue from customers it later finds breaking its usage policy or commercial terms, a wider group than distillers, at about 5 to 7% for the nine months to September 30, booked before their access is cut off; the FT and The Information, citing people at an investor meeting, had reported the figure as distillation. The piece reads distillation as a paid distribution channel that priced the answer and never the capability, walks through the counter-moves (summarised reasoning, preserved thinking for new API accounts, a two-stage classifier, bans, billing for blocked requests since September 24), and holds them against airline look-to-book limits: the same shape, but airlines meter searches because searches cost money, while a reasoning transcript is a capability the buyer keeps.
On October 12 Anthropic published a post about distillation, the practice of training a cheaper model on a stronger model's outputs, and in the middle of it sits a sentence few companies write about their own customers: "Defenses are expensive, and illicit distillers are still paying customers." The post says Anthropic has "turned away meaningful revenue and trillions of tokens' worth of paying traffic from distillers," and that "the incentives in the industry often cut the other way."
Two days later Anthropic met investors, and per the FT and The Information, citing people at the meeting, it put distillation at 5 to 7% of revenue. On October 26 the number went on the record in its IPO filing, under a wider label: customers it later finds using its models "in violation of our usage policy or commercial terms," about 5 to 7% of revenue for the nine months to September 30. The filing also says when that money is booked: "we recognize revenue from such customers when the related services are provided, before restricting or terminating their access."
So for a while the frontier reached its competitors the ordinary way. Through the API, on an invoice.
The buyer who wanted the seller
The post names names, and they are Anthropic's allegations. It says Zhipu "distilled the cyber capabilities of leading US models during the development of GLM-5.3," and that requests to Moonshot's Kimi models were "secretly forwarded to Claude." In February it described about 24,000 fraudulent accounts tied to DeepSeek, Moonshot and MiniMax, some run through proxy networks. Neither Zhipu, which sells as Z.ai, nor Moonshot had replied to Reuters. Zhipu's previous open model, GLM-5.2, is the one Anthropic's own red team used as the bar for a model that copies itself across cheap devices, which is where a capability bought by the token can end up: free to download, beyond anyone's recall.
Nothing published ties the 5 to 7% to those labs, either. The filing's bucket holds every customer caught breaking the usage policy or the commercial terms, and it names distillation only among its competition risks, with no number beside it. Distillers buy through proxies and resold accounts, so some of that money is theirs. If most of it is something else, the rival channel was a good deal smaller than the percentage.
The post is clear about what the distillers were paying for. "The most valuable kind of data for this purpose is transcripts of Claude's reasoning." In Anthropic's test, a model trained on full reasoning transcripts scored 80.4% on SWE-bench Verified, a standard coding benchmark; trained on summaries of the same transcripts, 71.8%. The answer was the receipt. The reasoning was the goods.
The counter-moves read like security engineering and work like a price list. Claude now summarises its reasoning before showing it. API accounts created on or after August 31 cannot edit Claude's prior context, which closes the trick of feeding hidden reasoning back in and asking for it verbatim. A two-stage classifier watches for extraction, with a false-positive rate Anthropic puts under 0.1%. Repeat offenders are banned, tens of thousands of accounts so far, often within two hours of a campaign starting. And since September 24 Anthropic has resumed charging for requests its safeguards block before Claude responds. You can now be refused and invoiced for the same request. Anthropic says early evidence puts data harvested down 90 to 99%, and adds: "We don't yet know how long these gains will last."
The buyer who wanted a seat
I spent much of my career in travel, and this customer has a familiar silhouette. Airlines answer live fare requests from resellers, and some resellers run thousands of searches for every booking, keeping the answers to power products of their own. The industry's answer is the look-to-book limit. Duffel, which sells airline inventory to developers, charges "$0.005 per excess search" once a customer's searches in a month pass 1,500 for every order booked. Billing for a blocked request is the same instinct with a different meter.
The rhyme holds on the meter and nowhere else. Duffel says why it charges: "to make sure we can adequately cover the costs of processing your searches." The airline's problem is the cost of answering. A fare harvester wants a seat to sell, and what it stores goes stale by the afternoon. A fare is a fish. Keep it too long and it is wrong. A reasoning transcript does not go off, and the buyer does not want a seat. It wants to be the airline.
Sell a man a fish and you have a customer. Teach him to fish, for a fee, and you have a competitor.
Every API price list assumes the buyer wants the answer. A distiller wants the next model, and no per-token rate was ever set for that, which is why the price Anthropic has settled on for it is a refusal, and since September a billed one.
—TJ