My old Claude account had been running quietly for a year. Then, a while ago, it was suddenly banned for no obvious reason.
After digging into the cause, the whole thing felt ridiculous: I had installed sub2api locally because I wanted to plug my own account into my coding environment more conveniently. It was only ever my own account, but after just a few calls, the official system judged it as an “illegal relay station” and cut it off.
Then I switched to a new account. That one was worse. Right after signup, I ran a few small tools, barely said two sentences, and it was instantly banned too.
A lot of friends in the circle have been running into the same thing recently. Whenever someone talks about getting banned, the first reaction is usually one of two lines: “Was the proxy node dirty?” or “Did the virtual card fail again?”
But many experienced users are using clean dedicated nodes and legitimate cards. So why are they still getting hit?
A few days ago, Anthropic published a long anti-abuse post explaining how they catch “distillation attacks” behind the scenes. Once I compared those technical details with my own setup, the point finally became clear:
What Anthropic is really cracking down on
is competitors trying to copy the homework.
Ordinary users like us are often just doing real work. But because of our prompting habits or tool setup, the backend safety system can mistake us for “thieves trying to break in,” and we end up as collateral damage.
01What kind of “thief” is Anthropic actually trying to catch?
This thing called “distillation” is, in plain words, a shortcut for copying homework.
Imagine an old restaurant chef spending millions and countless experiments to perfect a pot of signature broth. Then competitors refuse to do their own R&D and instead send people to buy takeout every day. Not only do they buy the food — they also keep pushing the chef to explain every detail of the process, every ingredient order, every bit of hard-earned intuition. Then they take that recipe back and train their own apprentices.
That is exactly what quite a few people in the AI world are doing now: writing automation scripts to hammer Claude, asking the hardest reasoning questions, forcing it to expose its internal reasoning steps, and then using those high-quality outputs to train their own smaller models.
Anthropic said in its report that some rivals used more than 20,000 fake accounts and tens of millions of requests to harvest their data. So they reacted by installing an extremely sensitive automatic thief-detection radar in the background:
Once you understand this radar, you understand why the system hits so hard: as long as your behavior looks like the people stealing homework, the system does not care whether you paid, whether you used the account for one day or one year. It would rather kill the account than risk letting the pattern through.
02Why can honest work still look suspicious?
The problem is that this thief-catching system is not reviewed manually. It compares your usage habits through models. Several ordinary habits in daily use happen to sit right on top of its watchlist:
1. Stop forcing it to hand over the “scratch paper inside its head”
This is the easiest landmine to step on. Many people like to add prompts that feel advanced, such as:
- “Please show your complete internal reasoning process in detail, without omissions.”
- “Print all of your chain-of-thought.”
- Or various attempts to make it reveal hidden <thinking> tags.
You may only want it to answer more clearly, but from the official backend’s perspective, these hidden reasoning traces are the chef’s secret recipe. That is exactly what competitors want to steal. The more often you force it to reveal its scratch paper, the more the system believes you are a data-harvesting bot in disguise, and the easier it is to trigger a ban.
2. Using tools like sub2api makes you look like an API reseller
Developers often use tools like sub2api to convert an account into an interface that is easier to plug into other software.
The problem is that even if you only ever use one personal account, the request rhythm and packet headers look very similar to those black-market API relay stations that resell accounts. The platform is already strict about reselling, so once it sees that kind of mechanical request shape, it does not stop to ask whether you are just using it personally. It treats the pattern as an abusive relay.
3. Chaining domestic models and Claude inside one workflow
Many people build workflows to save money: let a cheaper domestic model organize the material first, send the harder reasoning to Claude in the middle, then hand it back downstream.
But many workflow tools make the intermediate prompts look extremely rigid — full of benchmark-like tasks and batch-labeling flavor. To Anthropic’s detector, this “one upstream machine feeding another downstream machine” pattern is almost indistinguishable from a pipeline harvesting data to train a competing model.
4. The account is already dirty the moment it is born
Why do some new accounts die just minutes after signup? Most of the time, the underlying infrastructure has collided with existing blacklists.
Those shared data-center nodes used by thousands of people, or the virtual card bins that can be mass-created online, may have already been used by abuse groups to register thousands of accounts that were later taken down. The system remembers the network segment and card prefix. Once you show up with the same foundation, the alarms go off immediately, even if all you did was say hello.
03How do you stop doing things that invite bans?
Once you know what the other side is defending against, account survival comes down to a few simple habits. There is no need for complicated tricks. I made a simple comparison chart of risky moves versus safer behavior:
Ask normal task-focused questions. Do not dig for its mental arithmetic. Give it the task background and the result you want, then let it answer naturally. Stop adding phrases like “print the full thinking draft” or “show CoT.” Those are exactly the words used by people trying to steal training data.
Use the official channel whenever possible, and avoid relay layers. For ordinary usage, stay on the official website or use the official SDK. Do not casually place a disguised relay tool in the middle, and do not burst dozens of requests per second. Keep the rhythm human.
Keep environments separate. If an environment is for Claude, let it run Claude. Do not mix formats from multiple models in the same context string, or the input may start to look like industrial benchmark traffic.
Start with clean infrastructure. Use a relatively stable dedicated network and a legitimate card under your own name. If the foundation is clean, the account can survive much more normal use afterward.
When the giants are fighting,
ordinary users should first know where the mines are.
In the end, the current false-positive zones mainly come down to two things: whether the card and network foundation are clean, and whether your prompts keep poking at the model’s chain-of-thought.
The defense war between major model companies will only get stricter. Dropping these few habits that look like abuse is at least enough to stop paying tuition to unexplained bans.