Anthropic Now Charges for Blocked Requests in Bio, Distillation and Frontier-LLM Categories

Anthropic will again charge for requests its safeguards block before Claude answers. ClaudeDevs announced it on X on September 24, 2026: the change applies only to "categories with low false positive rates: biology, distillation attacks, and frontier LLM development," and the company framed it as one layer of defense against "coordinated attacks on our systems in recent weeks."

The reaction was immediate and mostly skeptical. One reply called it "paying for rejection," another asked how charging "serves as a defense against attacks" at all. Both are fair questions, and the documentation Anthropic published alongside the announcement answers more of them than the tweet does.

TL;DR: what changed and who it touches

What does "billable block" mean in practice?

A refusal on the Claude API is not an error. It is an HTTP 200 response with stop_reason: "refusal", empty content, and a stop_details object naming the policy area. Before this change, a refusal that arrived before the model produced any output cost you nothing except a rate-limit hit. Now, for three categories, it is billed like any other request.

Anthropic's refusals and fallback documentation lists the categories and their billing status side by side:

The docs explain the logic directly: "To disrupt attempts to circumvent Anthropic's safeguards at scale, a refusal that arrives before any output is billed" in the categories "where Anthropic measures low volumes of false positives, as of September 2026." They also warn that the list "may change as Anthropic keeps measuring and refining its safeguards' false positive rates."

Reading the tweet against the docs

The tweet names three areas: biology, distillation attacks and frontier LLM development. The docs name three categories: bio, frontier_llm and reasoning_extraction. The docs do not say "distillation" in the category table, so mapping distillation attacks onto reasoning_extraction is our inference, not something Anthropic states. It fits, though: distillation campaigns typically try to harvest a model's reasoning traces to train a rival, which is exactly what a reasoning-extraction classifier would flag.

That matters because Anthropic has been public about distillation for weeks. It caught Moonshot and DeepSeek serving Claude's answers as their own and documented a 151-million-exchange Alibaba campaign, and the surrounding policy fight is covered in our American distillation regime and Fable 5.1 chain-of-thought posts. Billing blocked attempts adds a cost to probing at scale: an attacker who fires thousands of extraction prompts through stolen or free-trial accounts now pays for the ones that get blocked.

Why does charging count as a defense?

The criticism from the thread is that charging a user for a request the model declined is "payment for services not rendered." That framing is correct for an honest user and beside the point for an attacker. The mechanism Anthropic is describing is economic, not technical:

1. Probing gets expensive. Jailbreak and extraction campaigns work by sending huge volumes of near-identical requests and keeping the ones that slip through. If every blocked attempt costs input tokens, brute-force iteration is no longer free.
2. It removes a free oracle. A free refusal tells an attacker "this phrasing was detected." Billing that signal turns classifier feedback into something with a price.
3. It only works where false positives are rare. Charging honest users would be indefensible if the classifiers were noisy, which is why the categories are limited to the ones where Anthropic says it measures low false positive volume.

None of this is verified independently. The under 0.1% false positive rate and the 99.7% figure are Anthropic's own testing numbers, and one commenter, a self-described lab scientist, said their team applied for the science-program access and got no response. Both things can be true: the classifiers can be well-tuned on aggregate and still be a real cost for a narrow group of biology users.

How this connects to the biology safeguards story

If you work in life sciences, this is the change to watch. In August, Anthropic rewrote Fable 5's biology classifier and cut false fallbacks by about 85%, but virology, toxicology and molecular design requests still fell back to a smaller model. Fallback meant a slower or weaker answer. Billing means a wrong block now also has a line item.

Anthropic's answer to legitimate researchers is its verification track, covered in our post on the life sciences verification program. If your organization does wet-lab or computational biology work with Claude, that program is the intended path, not fighting the classifier one request at a time.

What API builders should change this week

Because a refusal is an HTTP 200, most monitoring never sees it. The docs' own advice is worth taking literally.

1. Instrument refusals as their own signal

Emit one event per refusal and one per fallback-served response, then alert on the gap. A dashboard built on 5xx rates will show a billing anomaly as "everything is fine."

resp = client.beta.messages.create(
    model="claude-fable-5-1",
    max_tokens=1024,
    messages=messages,
    fallbacks="default",
    betas=["server-side-fallback-2026-07-01"],
)

if resp.stop_reason == "refusal":
    log_refusal(
        category=(resp.stop_details.category if resp.stop_details else None),
        input_tokens=resp.usage.input_tokens,
    )

served_by_fallback = any(
    it.type == "fallback_message" for it in (resp.usage.iterations or [])
)

2. Turn on fallback, and use credit

Server-side fallback (beta) retries a refused request on the model Anthropic recommends for that category, inside one API call. Fallback credit then compensates for the fallback model's prompt-cache miss. The SDK middleware does the same for Bedrock, Google Cloud and Foundry, where server-side fallback is not available. If you write the retry by hand, redeem the credit on every retry or you pay to cache the conversation twice.

Two details to get right:

• Configure exactly one mechanism. Use either the fallbacks parameter or the SDK middleware on a request, never both.
• Give sub-agents their own fallback. The parameter does not propagate into model calls made from inside tool execution.

3. Check what gets billed on a fallback

When fallback runs, the refusal that triggered it is billed if it arrived mid-stream or falls in a billed category, and the fallback request is billed too. The usage.iterations array is the per-attempt record: a declined attempt shows up as a message entry, the serving model as fallback_message. Reconcile your invoice against that array, not against the top-level usage, which only describes the attempt that produced the returned message.

4. Screen prompts for extraction-shaped language

If your product legitimately asks Claude to "show your reasoning" or "reproduce your chain of thought" in the response text, expect reasoning_extraction blocks, which are now billed. The docs' suggested alternative is adaptive thinking, which returns reasoning in a structured form instead.

Which categories are likely to catch legitimate work?

Anthropic itself notes that "benign machine learning work can also trigger" frontier_llm, and "beneficial life sciences work can also trigger" bio. The classifier being tuned for a low false positive rate is not the same as it having none.

Who pays if you are a Claude Code user?

The announcement says 99.7% of accounts using Claude Code, Claude.ai or Cowork hit none of the new billable blocks. Anthropic has not published how billable blocks are counted against subscription plans, so treat any usage impact as unconfirmed. Whatever the accounting, it lands in an already tense moment: our coverage of the Claude Code limit cut and cancellations shows how sensitive the community is to anything that shortens a session. If a legitimate request is blocked, report it with /feedback so the example reaches the team improving the classifiers.

What this means for what you build or pay

• Budget: add a small line for blocked requests if your product touches biology, ML training or model introspection. For most apps the number will round to zero.
• Architecture: treat refusal handling as a first-class path, with fallback configured on every request path including retries and background workers.
• Risk: the billable list can grow. The docs say so plainly, so do not hard-code "only three categories" into your cost model.
• Compliance: if you resell Claude access to end users, decide now whether you pass blocked-request costs through, absorb them, or rate-limit the accounts that generate them.

The strategic read is that safeguards are becoming metered infrastructure. Free classifiers were an open invitation to iterate. Priced ones move some of the cost of abuse from Anthropic to the abuser, and the price of being wrongly flagged lands on a small group that has to argue for a refund case by case. Whether that trade holds up depends on the false positive rate staying where Anthropic says it is.

Related reading on explainx.ai

• Fable 5 biology safeguards update: 85% fewer false fallbacks
• Moonshot and DeepSeek secretly served Claude
• Garry Tan and the American distillation regime
• Claude Fable 5.1 and Mythos 5.1 launch: benchmarks and pricing
• Claude Code token efficiency and prompt cache guide
• Claude Code limit cut: reaction and cancellations
• Anthropic threat intelligence report, September 2026
• Anthropic life sciences verification program

Official sources: ClaudeDevs announcement on X and Anthropic's Refusals and fallback documentation on platform.claude.com.

Billing rules, category lists and rates reflect Anthropic's announcement and documentation as of September 25, 2026 and may change as Anthropic refines its classifiers.