Anthropic details cross-session replay attacks used to steal Claude's chain-of-thought
Miles_Brundage · x · 2026-10-14
Anthropic published a post detailing months of progress against distillation attacks on Claude. Security researcher Matthew Green pushed back, saying he reported these cross-session replay attacks in May and was told "it isn't an attack."
The technique: Claude's API returns a "thinking signature" instead of raw reasoning to prevent distillation, but Moonshot circumvented this by saving the signature, starting a new session, and eliciting Claude to convert it back into the full reasoning trace—harvesting CoT transcripts at scale. Anthropic also describes distillers moving reasoning blocks between conversations, between models (using weaker-safeguard models to extract stronger ones), and between accounts via proxy networks to survive bans. New defenses are now in place.
More from Models
- Google's gemini-4-demo-vanilla-3D repo surfaces, hinting at Gemini 4 3D demos — fofrAI · 2026-10-14
- Gemini 4 Argon goes live on Vercel AI Gateway at 50% off as rauchg hails coding agents as AI's killer app — AccBalanced · 2026-10-14
- DIY CrusaderBench ranks Gemini 4 Argon #1 at Stronghold strategy, beating Opus 5.5 — Hesamation · 2026-10-14
- Meta's Muse Wonder ships without a single cost-vs-score plot, researchers cry foul — AccBalanced · 2026-10-14
- Google offers free Antigravity access to researchers, seizing on OpenAI's mathematician backlash — altesc_create · 2026-10-14
- Designer: new model is highly capable at design but defaults to generic 'AI slop' look unsteered — zacharynado · 2026-10-14