Anthropic Anti-Distillation Defenses and Agent-Scale Source Control

Two Anthropic posts this week describe the same company from opposite ends: one is about protecting a model from industrial-scale theft, the other about what happens when your own agents outgrow the infrastructure beneath them. Both matter to anyone whose product sits on top of Claude's API — because one changes what your integration is allowed to do, and the other predicts what your development workflow will need next.

What Anthropic Announced

On October 12, Anthropic published Strengthening our defenses against distillation attacks: new methods that they estimate have "reduced the amount of data harvested by distillers by around 90 to 99%," with reasoning tokens extracted by distillers on their own platform now "consistently 10 to 100 times lower" than before the new safeguards.

On October 13, the engineering blog followed with Redesigning source control at Anthropic: in May 2026 the company merged around 2,500 code changes per day; by September, over 30,000 per day — a 12× jump that bottlenecked infrastructure built for humans, so a seven-person team built Scion (an in-house version control system), Antique (code review), and migrated the entire monorepo from git in five months.

The Anti-Distillation Stack, Read for API Builders

Distillation attacks are covert campaigns to replicate a frontier model's capabilities by harvesting its outputs — and the most valuable harvest is the reasoning transcript, the thinking Claude writes before answering. Anthropic's post quantifies why: a model distilled from full Opus 4.8 transcripts scored 80.4% on SWE-bench Verified; the same distillation on summarized transcripts scored 71.8%. That 8.6-point gap is why reasoning transcripts are worth protecting.

The defense stack now has three layers, each with a builder-facing consequence:

That last row is easy to miss: as of September 24, requests that trip safeguards (in areas including distillation, where the false-positive rate is below 0.1%) are billed even though Claude never responds. Anthropic is pricing attack attempts as attempts. If your batch jobs generate unusual phrasings at volume, a classifier false positive is now a line item, not a free retry — and the research post is candid that they haven't fully met their original no-impact-for-legitimate-users goal.

Scale context makes the stakes legible. Anthropic describes one lab that tested 12,000 requests, each a different extraction trick, and proxy networks of "hundreds of thousands of fraudulent accounts" — one network alone managed 20,000+ accounts simultaneously. The named cases matter for the competitive picture: Zhipu distilled cyber capabilities of leading US models during GLM-5.3's development (with CAISSI assessing GLM-5.3 as the most cyber-capable open-weights model to date), and Moonshot's Kimi secretly forwarded requests to Claude. We've covered the commercial side of this fight before — Meta restricting Claude Code over training-data contamination fears and Anthropic's Senate letter accusing Alibaba of the largest known distillation attack. This research post is Anthropic's technical answer to those cases.

Anthropic also states the cost of their own stance plainly: they've "turned away meaningful revenue and trillions of tokens' worth of paying traffic from distillers." OpenAI made a different trade recently — encrypting agent instructions to protect prompt IP at the product layer. Watch which approach the rest of the industry adopts; the two are complementary, not competing.

What Agent-Scale Source Control Says About Your Future

The Scion post is the more useful one for most readers, because it describes a workload that any team running agents at volume will eventually hit. The numbers: main-branch history of ~100 GB, a compressed working copy over 25 GB, and on the order of 25 million code checkouts per day for CI — naive git fetches would exceed 600 PB daily. At peak, Anthropic ran several hundred internal git mirrors to cope.

The design pivot is one sentence: their clients are agents and CI jobs that are always online, so git's core strengths — offline operation, full local copies, every client a server — became liabilities. Scion's principles, in order of how transferable they are:

• All source-control questions become server APIs. Blame, diff, merge-base, ancestry — queried, not computed from a local clone. Most jobs don't check out code at all.
• Commits happen server-side, as cheap, incremental, lock-free "changesets" (write-ahead-log entries storing changed files plus content-addressed blob pointers, with derived data like blame computed recursively from parents).
• Sparse and virtualized checkouts pay only for files actually read.
• Refs are discouraged — global state that every server must agree on is the scaling wall.

Results claimed: every cache tier above a 99% hit rate, a 200× smaller infrastructure footprint than the git-mirror setup, checkouts "two orders of magnitude faster" (seconds, not minutes), and a 25% CI CPU capacity win.

The process lessons generalize further than the architecture. The team's example of an early internal snapshot of Claude Mythos Preview rewriting the git-to-Scion ingestion pipeline — unprompted, 20× less memory and 4× faster, preserving all ingestion invariants — is the strongest concrete artifact in either post. And their account of the changed human role will sound familiar to anyone running agent fleets: engineers rate Claude as better at writing code than themselves, so their work shifts to design tradeoffs and, in their words, telling Claude "no" — while reviews examine the intent of a change rather than every line. For related takes, see our writeups of Dan Luu's agentic-coding notes and agent-scale engineering lessons.

One process change deserves a flag for anyone running CI at growing agent volume: Anthropic concluded that a proper merge queue "doesn't make much sense at agent scale," and replaced it with post-merge and pre-deploy automated testing, accepting concurrent conflicts that Claude fixes "faster than humans can even identify them." If your merge queue is the bottleneck and your conflicts are machine-fixable, that's a template, not a curiosity.

What Scion Doesn't Solve

Anthropic is explicit that Scion is not a git replacement for general use: it requires migrating every piece of the development lifecycle, it's bespoke, and it hasn't been released publicly because it's hard to offer in a form useful to other organizations. The contribution they intend is the pattern — git platforms exposing server-side RPCs, better negotiation protocols, sparse and shallow features that compose. If you run a monorepo that's straining, that's the wishlist to bring to your platform vendor; if you're at ordinary scale, git is still the right answer, and the post says so.

What to Watch

The 90-99% harvest reduction is Anthropic's own estimate, and the post concedes the obvious: this is a cat-and-mouse game, the gains may not hold, and no maximally sophisticated attacker has tested the defenses yet. The billing change deserves monitoring on your invoices. And Anthropic's own observation — "the latent demand for merging code is practically infinite" — is worth keeping in mind for your repo too; when your CI checkouts start costing minutes instead of seconds, the agent-scale transition has reached you.