Two things happened in AI security recently and they belong next to each other.

Mozilla published a Hacks post proposing PACT (Private Access Control Tokens): a design for anonymous, unlinkable, cryptographically rate-limited credentials for the web. Anchors like VPN providers or subscription services vouch for you. Per-site Moderators turn those vouchings into stateful tokens a site can rate-limit against, without learning which Anchor issued the vouching or which user is behind the token. Careful cryptography by people who know what they’re doing.

Three days later, Anthropic quietly ripped out a covert tracking system inside Claude Code. The code embedded fingerprinting signals, like timezone, proxy usage, apparent affiliation with Chinese AI labs, into system prompts, in a way Chinese users wouldn’t easily see. Anthropic’s stated purpose was distillation defense: catching users querying Claude to train competing models. They said it was an experiment from March. They pulled it after Reddit found it.

You could write this up as Mozilla-good, Anthropic-bad. I don’t think that’s the honest read.

Anthropic wasn’t chasing surveillance for its own sake. Distillation is real. DeepSeek, Moonshot, MiniMax, and Alibaba have all been accused of training on Claude outputs at scale, and it’s an existential business threat if you’re the shop paying for the training run being copied. What Anthropic did was reach for prompt-embedded geo-fingerprints because the honest tool for their problem doesn’t exist.

Which is where reading the two announcements together gets uncomfortable. PACT makes Anthropic’s problem structurally worse, not better.

The whole point of PACT is that a site can’t correlate credential presentations across time, can’t see which Anchor issued the vouching, and can’t tell one holder from another beyond a rate-limit bit. Those are exactly the properties Anthropic would need to defeat to catch a distillation ring. Distillation isn’t a volume attack you can rate-limit your way out of; a determined adversary spreads queries across many accounts over many days. It’s a correlation problem, whose accounts, whose behavior, whose IP ranges. PACT’s core cryptographic promise is that you don’t get to know.

So the model vendors have a real business need (tell legitimate traffic from adversarial traffic), the privacy community is building crypto that structurally denies them that need, and no primitive I know of squares the circle. Anthropic’s fingerprinting stunt is what it looks like when a vendor tries to have both anyway.

Here’s the part I keep coming back to. Distillation defense is going to be the AI industry’s DRM moment.

Content owners had a legitimate interest in preventing unauthorized copying. No crypto primitive existed that gave them content protection plus user autonomy. So the industry shipped increasingly invasive tools instead. Always-online activation, Sony’s audio-CD rootkit, hardware attestation chains for video playback, browser-signed media paths. Users routed around all of them. The cycle burned trust for years and did not solve the problem it claimed to.

I think we run the same tape. Anthropic is the first crack. Someone will ship API keys attested to hardware. Someone will demand identity verification to unlock the higher rate-limit tier. Someone will start rejecting traffic that doesn’t match a behavioral profile of a “real” developer. Every one of those will get discovered, get a Semafor writeup, get pulled or quietly renamed. The underlying tension, that model outputs are training data, and you can’t cryptographically prevent that downstream use without cryptographically identifying the upstream user, has no technical fix I can see.

The version of this argument no one in the AI vendor camp wants to say out loud: distillation defense and user privacy sit on opposite sides of an information-theoretic wall. You have to pick. If it’s privacy, then price the API to make distillation economically stupid and let it go. If it’s attribution, then rewrite the marketing page. Trying to keep both and pretending last week didn’t happen is how you end up with a Reddit thread on your Monday morning.

Sources: Mozilla Hacks on PACT; Semafor, The Register, and The Information on the Claude Code tracking rollback.