Anthropic's Claude API Distillation Crackdown: What AI Agencies Must Change in 2026

The report is Anthropic's own account of enforcement it took, and the geopolitics is not the useful part. Three questions decide your exposure this quarter: does anything in your stack train on Claude inputs or outputs, does client traffic pass through a gateway you do not control, and does your harness edit the conversation history it resends?

What Anthropic's Usage Policy actually prohibits

The exposure is contractual, and the document travels with the API account: the Commercial Terms of Service (17 June 2025) incorporate the Usage Policy, the Supported Regions Policy and the Service Specific Terms by reference.

The distillation clause

One line in the Usage Policy's "Do Not Abuse our Platform" section is the whole ballgame for a wrapper business:

Utilization of inputs and outputs to train an AI model (e.g., “model scraping” or “model distillation”) without prior authorization from Anthropic

It covers inputs as well as outputs, so a pipeline that logs prompts and completions and fine-tunes on the pairs is inside the prohibition. The trigger is the missing authorization — the help centre's phrasing is "without our written permission" — so a permission request is a real path for a use case you can defend. The section also bans facilitating access for "persons, entities, or users in violation of our Supported Regions Policy", so a reseller in your path can put you there silently.

The platform-abuse clauses

That section also describes what scaling agencies do by accident: coordinating activity across multiple accounts, automating account creation, circumventing a ban "through the use of a different account", and generating "identical or similar inputs that otherwise violate our Usage Policy". If your growth plan involves extra accounts to spread rate limits, that plan is the violation — not the prompts.

What enforcement looks like from your side

The policy states the mechanism plainly: "If we learn that you have violated our Usage Policy, we may throttle, suspend, or terminate your access to our products and services." Anthropic's safeguards article (9 July 2026) lists three ban triggers — repeated Usage Policy violations, account creation from an unsupported location, and Terms of Service violations — and adds a detail aimed at organisations: "For API customers, these warnings are linked to ongoing thresholds of violative behavior across their entire API account."

One client's runaway script can move your whole account toward a threshold.

The line between a fine-tune you may ship and one Anthropic bans

Anthropic permits training on Claude outputs — narrowly, and in writing. The dividing question is what the finished model competes with.

What you may train on Claude Outputs

Anthropic's help centre (16 March 2026) is specific: "You can use Claude's Outputs to train models that don't compete with Anthropic's own models." Six categories are named — sentiment analysis, content categorization, summarization, information extraction, semantic search and anomaly detection. Those are the shapes of a narrow, task-specific system: a ticket classifier, a summariser, an extractor. Outputs can also be integrated into applications to "generate content for your customers", so Claude-generated copy is a permitted client deliverable.

What is prohibited

The prohibited side is defined by competition. "Our Terms do not allow the use of Outputs to train models that are competitive with Anthropic's own", the article says, and "It is also a violation of our Terms to support a third party's attempt to do the same". Four uses are named: general purpose chatbots, models designed for open-ended text generation, using Outputs as training targets, and reverse engineering training methods. Hosting that training run for a client is as much a violation as running it yourself — the same vendor-claims risk appeared in the 2026 copyright case.

Where synthetic data sits

Synthetic data is where these conversations go wrong. Generating synthetic content with Claude — test fixtures, marketing copy, training data for a smaller internal model — is permitted as long as the model you feed does not compete with Claude. What is prohibited is using Claude's answers as the training targets for a model that will do the same open-ended job. The test applies to the finished model, not to how clean your pipeline is: if your use case sits near that line, request written permission before you build.

What the distillation campaigns looked like technically

The report's value to an agency is diagnostic: Anthropic describes mechanics your telemetry should rule out.

The techniques Anthropic says it observed

• Forced reasoning extraction. Alibaba's pipeline "injected a fixed prompt into each request that forced Claude to write out its reasoning traces inside inline text tags", then used the transcripts to "distill Claude's capabilities into Qwen 3.5, 3.6, and 3.7" — peaking near 3 million exchanges a day from more than 3,500 fraudulent accounts.
• Reasoning replay. Zhipu (Z.ai) was "replaying captured Claude reasoning traces back through Claude", counting "770,609 exchanges passing through the CoT-extraction cleaner" in ten days.
• Relaying customer traffic. Moonshot forwarded its own users' requests to Claude and kept the exchanges — Anthropic counted "almost 300,000 customer requests" in a ten-day period — and DeepSeek ran a similar chain-of-thought pipeline.
• Proxy and reseller infrastructure. Moonshot routed through "a proxy service network of 5,380 fraudulent accounts"; MiniMax built a proxy network "through a shell company"; SenseTime's pipeline "included transcripts of user exchanges with Claude purchased from third-party data vendors".

The common denominators are volume, repetition, account rotation and context tampering — not prompt wording.

Why a reseller or proxy in the path is the fastest way to lose an account

Anthropic describes proxy networks that "both provide Claude access to users in unsupported regions, and also save exchanges in order to sell them to other labs". With the policy's ban on facilitating such access, every gateway between your application and the API is a governance question: if you cannot name the entity terminating your TLS connection, you cannot answer it. See this AI vendor risk assessment walkthrough.

The uncomfortable case for agencies

The report also documents conversations relayed into Claude without the knowledge of the people in them: those sessions "contained names, email addresses, company data, and other sensitive data of hundreds of end users in at least a dozen languages". Customers had no idea their vendor had swapped the model behind the interface — a data-handling failure, not a model-quality one. The buyer-side version lives on our sister site: the corporate data-handling audit for vendor AI.

Migration checklist: six changes to make in your harness this month

1. Inventory every path that resells, sub-resells or proxies Claude access. Name the entity holding the key for every product and workflow that touches the API, and mark anything where a third party terminates the request. "We did not know a reseller was involved" is not a defence the policy offers.
2. Audit every non-Anthropic gateway in the path. A vendor that cannot produce a subprocessor list is itself the finding, because an unauthorized route puts the account at risk regardless of how clean your prompts are.
3. Make your harness compatible with preserved thinking. With Fable 5.1, accounts created on or after 31 August 2026 cannot modify the system prompt, tools or messages preceding a thinking block in a multi-turn conversation; the API errors unless the caller opts into "non-strict" mode and lets those thinking blocks be dropped. Anthropic's stated reason: such modifications "are also a common and publicly documented technique for industrial-scale illicit distillation". Re-test your context compaction and system-reminder injection. Existing accounts and Claude Code are unaffected for Fable 5.1; for harness cost, read the September 2026 Claude Code limits change.
4. Kill any "model output as training target" pipeline. Replace it with a permitted classifier, summariser or extractor pattern, and document the decision. The six permitted categories are the safe harbour; a general-purpose or open-ended generator is not.
5. Get the account posture right. Complete identity verification where Anthropic asks, keep egress out of unsupported regions, keep one accountable owner per workspace, and name who will run an appeal — the Commercial Terms require you to cooperate with information requests that verify identity and use. If you have not done a toolchain security audit, start there.
6. Document it for clients. Write down what you send, where it goes, who can see it, and what happens to a client project if the account is throttled. Anthropic gives enterprise customers evidence through the Compliance API and audit logs, and its guidance includes disclosing to users that they are interacting with an AI system.

How to answer a client who asks whether their data was used to train a model

Agencies are already fielding this in vendor-security reviews, and a defensive answer reads worse than a precise one. Three questions answer it honestly in a day.

1. Does anything in the path use Claude inputs or outputs as training data? Include your own fine-tunes and any vendor selling "we improve the model with your data" as a feature.
2. Does client traffic pass through a gateway you do not control? Name the entity, the region it terminates in, and whether it retains copies.
3. If a client's conversation was relayed without their consent, what does your contract say? Disclosure and notification language turns a bad week into a handled one.

If you are on the buying side, the questions invert usefully: see how to vet an AI agency for the version a client should be asking you.

What we are not claiming

Anthropic is both the source of these findings and the enforcer of its own policy: everything above describes a company's account of action it took against accounts, not an adjudicated finding. Beijing rejected the report on 11 September 2026, with Chinese Foreign Ministry spokesperson Mao Ning saying "We firmly oppose attempts to throw mud at China by distorting facts". Nathan Lambert's The distillation panic argues the term is applied far more broadly than the evidence supports. Neither changes the advice: the clause is real, the API change is live, and the account is yours.

Frequently asked questions

Sources

Primary: Anthropic's September 2026 misuse report (154-page PDF), the Usage Policy, the Commercial Terms of Service, and Help Center articles on Outputs and model training, preserved thinking, warnings and appeals, launching a Claude API product and supported countries. Press and analysis: TechCrunch, Anadolu Agency and Interconnects.