“Anthropic has acknowledged that its models are vulnerable to distillation attacks, where a smaller model can be trained by querying the larger model's API.”