Distillation attacks have given Anthropic a reason to start charging for requests that Claude never answers. On 24 September 2026, the company’s developer account, @ClaudeDevs, posted on X that it would “resume charging for requests our safeguards block before Claude responds”. The charge applies in three categories, which the post named as “biology, distillation attacks, and frontier LLM development”. Anthropic said it had “seen some coordinated attacks on our systems in recent weeks, and this is one layer of defense.”
The same change appeared that day in the Claude Platform release notes and on the documentation page for refusals. Those documents are more precise than the post. They name three billed refusal codes, and they show that the category the post calls distillation attacks is the one used when a request asks Claude to reproduce its internal reasoning. Two of the three billed categories exist to stop rival labs turning Claude’s answers into training data for their own AI models.
This article sets the announcement against the primary documents: the refusals documentation, the release notes back to May, a same-day commit to Anthropic’s cookbook, and the company’s own reports on distillation attacks from February and September. It also covers what the change means for machine learning teams, biology researchers and anyone building agents on Claude. For the September report itself, see our coverage of the distillation campaigns Anthropic attributed to Alibaba, Moonshot AI and DeepSeek. For Washington’s view, see our piece on the US advisory on Chinese distillation.
Table of contents
- What Anthropic Announced About Distillation Attacks on 24 September
- The Three Billed Categories Behind the Distillation Attacks Label
- Why “Resume”? The 114 Days When Refusals Were Free
- How Distillation Attacks Extract Claude’s Reasoning
- What Blocked Distillation Attacks Cost at Claude’s List Prices
- Reading the 99.7% and 0.1% Figures on Distillation Attacks Blocks
- Who Is Most Exposed When Distillation Attacks Are Blocked
- How Fallback Billing Works Alongside Distillation Attacks Charges
- What Developers Should Change Before the Next Invoice
- Will Charging for Blocks Deter Distillation Attacks?
- Frequently Asked Questions About the Distillation Attacks Charge
- References and Further Reading
What Anthropic Announced About Distillation Attacks on 24 September
The announcement was short, and most of the detail sits in the documentation it linked to. It reached developers in three places on the same day: a post on X, a dated release note and an updated documentation page. Read together, they describe a narrow billing change aimed at distillation attacks and biology misuse, not a general charge for refusals.
The post from @ClaudeDevs
The post went up at 17:11 UTC on Thursday 24 September and ran to two paragraphs. The first set out the change: “Today, we’ll resume charging for requests our safeguards block before Claude responds. This only applies in categories with low false positive rates: biology, distillation attacks, and frontier LLM development.”
The second paragraph gave two figures. “In recent testing, 99.7% of accounts using Claude Code, Claude.ai, or Cowork did not hit any of these newly ‘billable blocks’,” it said. “The classifiers behind the blocks we’re resuming charging for today are tuned to have a <0.1% false positive rate. We know that’s not 0%, and we’re going to keep improving them so they interrupt your work less often.”
It asked anyone who thinks a request was blocked wrongly to report it with /feedback in Claude Code, and it linked to the billing section of the refusals documentation. Roughly three hours after it went up, the post had 1,511 likes, 64 reposts, 220 replies and 269,481 views. A Hacker News submission of it drew five points and two comments in its first hours.
What the release note adds
The Claude Platform release notes carry an entry dated 24 September. It says Anthropic is “expanding which refusals are billed to include refusals that arrive before any output when stop_details.category is "bio", "frontier_llm", or "reasoning_extraction", the categories where we measure low volumes of false positives.”
The entry adds four details the post left out. Mid-stream refusals “were already billed”. The newly billed refusals “are charged like any other request, at the rates of the model that ran it”. Refusals before any output in other categories “are still not billed”, and fallback credit is unchanged. Finally, “This change applies on all platforms.” The documentation lists those as the Claude API, Amazon Bedrock, Claude Platform on AWS, Google Cloud and Microsoft Foundry. The entry never uses the phrase distillation attacks; it speaks only in category codes.
What the documentation now says
The refusals page presents the rule as a security measure. “To disrupt attempts to circumvent Anthropic’s safeguards at scale,” it says, a refusal before any output “is billed when its stop_details.category is "bio", "frontier_llm", or "reasoning_extraction".” It calls these “the categories where Anthropic measures low volumes of false positives, as of September 2026”, and warns that “the billed categories may change”.
Whatever the category, a refused response carries no content, token counts still appear in usage, and “the request still counts against your rate limits.” For a team that never trips a safeguard, nothing changes. For anyone running distillation attacks at volume, every blocked attempt in those categories now has a price.
The Three Billed Categories Behind the Distillation Attacks Label
Claude’s safety classifiers run on four of Anthropic’s AI models: Claude Fable 5.1, Claude Fable 5, Claude Opus 5.5 and Opus 5. When one declines a request, the API does not return an error. It returns a normal HTTP 200 response with stop_reason: "refusal", an empty content array and a stop_details object whose category field names the policy area. The classifiers also cover cybersecurity, but that category is not billed. There are five named categories, and the table sets the documentation’s definitions against the post’s wording.
| Category code | What the documentation says it means | Billed before any output | Name in the X post |
|---|---|---|---|
cyber | Could enable cyber harm, such as malware or exploit development; benign security work can also trigger it | No | Not mentioned |
bio | Could enable biological harm, such as dangerous lab methods; beneficial life sciences work can also trigger it | Yes | Biology |
frontier_llm | Could assist the development of competing models, which Anthropic’s commercial terms restrict; benign model-training work can also trigger it | Yes | Frontier LLM development |
reasoning_extraction | Asks the model to reproduce its internal reasoning in the response text | Yes | Distillation attacks |
general_harms | A usage-policy area outside the four named categories; benign work can also trigger it | No | Not mentioned |
reasoning_extraction is the category the post calls distillation attacks
The phrase “distillation attacks” does not appear as a category code anywhere in the API. The closest match is reasoning_extraction. Anthropic added it on 9 June 2026, the day Claude Fable 5 launched. The release note for that day says it is “returned when a request is blocked under Anthropic’s Terms of Service restrictions on reverse engineering or duplicating model outputs.”
That wording tracks section D.4 of the Commercial Terms, which says a customer may not “reverse engineer or duplicate the Services”. The documentation describes the category more plainly: the request “asks the model to reproduce its internal reasoning in the response text”. It also points to a legitimate route: “To get reasoning in a structured form instead, use adaptive thinking.” As later sections show, forcing Claude to write out its reasoning was central to the largest distillation attacks Anthropic has recorded.
frontier_llm covers competing model development
The frontier_llm code is the post’s “frontier LLM development”. The documentation says such a request “could assist the development of competing AI models, which is restricted under Anthropic’s commercial terms”. The clause it points to is the first half of D.4. A customer must not “access the Services to build a competing product or service, including to train competing AI models or resell the Services except as expressly approved by Anthropic”.
Anthropic’s Usage Policy, effective 15 September 2025, puts the same restriction in distillation terms. It prohibits “Utilization of inputs and outputs to train an AI model (e.g., ‘model scraping’ or ‘model distillation’) without prior authorization from Anthropic”. So frontier_llm and reasoning_extraction both guard against distillation attacks, from different angles. One looks at what a request is for. The other looks at what it asks Claude to reveal.
bio is the only billed category not about rival models
Biology is the odd one out. The bio code covers requests that “could enable biological harm, such as dangerous lab methods”. It sits in the billed group because Anthropic says its false positives there are now low, not because it has anything to do with distillation attacks. That claim rests largely on a safeguards update from 7 August, covered below, which Anthropic says cut biology-related fallbacks by about 85%.
What stays free: cyber and general_harms
Two categories are not billed before output: cyber and general_harms, along with any refusal whose category is null. The cyber exclusion is the notable one. Anthropic has said openly that its cybersecurity classifiers on Fable 5 carry the widest safety margin of any launch. Its 30 June post on redeploying Fable 5 said the margin was “much larger than in any prior launch”, meaning that “many more benign requests would be blocked”.
Billing those blocks would have charged legitimate security teams for work the classifier was never meant to stop. The line Anthropic has drawn is about confidence, not severity. It bills where it trusts its classifiers, and leaves cyber free even though cyber misuse sits alongside distillation attacks in its threat reporting.
Why "Resume"? The 114 Days When Refusals Were Free
The post says Anthropic will “resume” charging, a word that points to a history the post does not explain. The release notes show that refusals before any output used to be billed, stopped being billed on 2 June 2026, and are billed again, for three categories only, from 24 September. That is a gap of 114 days, and the timeline below shows what happened in between to the classifiers aimed at biology and distillation attacks.
| Date (2026) | What changed | Source |
|---|---|---|
| 28 May | The stop_details field is publicly documented, with categories cyber, bio or null | Release notes |
| 2 June | Claude API stops billing a request refused before any output | Release notes |
| 9 June | Claude Fable 5 launches with new classifiers; reasoning_extraction is added; pre-output refusals “not billed” | Release notes; launch post |
| 12 June | A US export control directive forces Anthropic to suspend Fable 5 and Mythos 5 for all customers | Anthropic statement |
| 15 June | Documentation lists frontier_llm; pre-output refusals are not billed and do “not count against rate limits” | Archived documentation |
| 1 July | Fable 5 and Mythos 5 return after the export controls are lifted on 30 June | Anthropic |
| 24 July | Server-side fallback gains a "default" mode that picks a fallback model by refusal category | Release notes |
| 7 August | Biology safeguards update cuts biology-related fallbacks by about 85% | Anthropic |
| 17 September | Life Sciences Verification Program opens applications | Anthropic |
| 24 September | Pre-output refusals in bio, frontier_llm and reasoning_extraction are billed again | X post; release notes; documentation |
What changed on 2 June
The 2 June entry is one sentence: “On the Claude API, you are no longer billed for a request when it returns stop_reason: "refusal" without Claude having generated any output.” Before that date, a request refused before any output was billed like any other. The change came a week before Fable 5, whose classifiers Anthropic knew would fire often. Its launch post said “we’ve tuned these safeguards conservatively”, adding that “they’ll sometimes catch harmless requests”, though they triggered “on average, in less than 5% of sessions”.
Waiving the charge made that strictness cheaper for customers to live with. Anthropic’s cookbook on Fable 5 fallback billing said so plainly until this week: “Input tokens are not billed on a direct classifier block.” The 24 September change reverses that, but only where Anthropic now trusts its classifiers, and only for biology and the two categories tied to distillation attacks.
The rate-limit rule changed too
A second change is missing from the release note. An archived copy of the refusals page from 15 June says a refusal before any output was not charged, “and the request does not count against rate limits.” The current page says the opposite for every category: “The request still counts against your rate limits.” Anthropic has not published a date for that change, and the 24 September entry covers billing only.
For most developers this matters less than the charge. For distillation attacks it may matter more. A pipeline that could fire blocked requests without touching its rate limits could probe the classifiers at no cost in capacity. Now each blocked attempt uses capacity whether or not it is billed.
The paper trail does not quite line up
Three small inconsistencies show how quickly the change was written up. Anthropic’s public cookbook repository received a commit at 17:05 UTC on 24 September, six minutes before the post, headed “update billing text for pre-stream refusal billing”. Its new text says pre-stream blocks outside the three categories are not billed “As of September 23, 2026”, a day earlier than the release note and the post’s “today”.
The same commit added frontier_llm to the cookbook’s list of categories for the first time, although the documentation already listed it on 15 June. And no release note has ever announced frontier_llm, while reasoning_extraction got its own entry. None of this changes what customers are billed, or how distillation attacks are detected. It does mean the release notes alone are not a complete record of how Claude classifies refusals.
How Distillation Attacks Extract Claude's Reasoning
Anthropic’s case for billing rests on what it has seen distillers do. Its two public reports describe distillation attacks that depended, above all, on getting Claude to write its reasoning out as plain text. That is the behaviour the reasoning_extraction category is built to block, and it explains why a billing rule is aimed at it.
The February disclosure on distillation attacks
On 23 February 2026, Anthropic published Detecting and preventing distillation attacks. It said three labs, DeepSeek, Moonshot and MiniMax, had generated “over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts”. It stressed that “Distillation is a widely used and legitimate training method”, and that the problem was using it to “illicitly extract Claude’s capabilities”.
It described one technique in detail. DeepSeek’s prompts “asked Claude to imagine and articulate the internal reasoning behind a completed response and write it out step by step—effectively generating chain-of-thought training data at scale.” DeepSeek also used rubric-based grading tasks that made Claude act as a reward model for reinforcement learning.
Among its defences, Anthropic listed classifiers and “behavioral fingerprinting systems designed to identify distillation attack patterns in API traffic”. It said this “includes detection of chain-of-thought elicitation used to construct reasoning training data.” The reasoning_extraction code, added four months later, is the visible, customer-facing end of that detection work against distillation attacks.
The September report
The September 2026 threat intelligence report went further. It said Anthropic had “identified and disrupted additional distillation attacks against Claude from seven labs based in China”. Several of them ran chain-of-thought (CoT) extraction pipelines.
Alibaba’s was the largest. It “injected a fixed prompt into each request that forced Claude to write out its reasoning traces inside inline text tags before providing its final answer.” The report says those transcripts became supervised fine-tuning data used to distil Claude’s capabilities into Qwen 3.5, 3.6 and 3.7. At its peak the campaign ran “nearly 3 million exchanges per day launched from more than 3,500 fraudulent accounts.”
Zhipu, branded outside China as Z.ai, “ran a chain-of-thought extraction pipeline against Claude, replaying captured Claude reasoning traces back through Claude to clean them”. The report counted 770,609 exchanges passing through that cleaner over 10 days in June. Moonshot and DeepSeek used what it calls a “cross-session replay attack”. They saved the reasoning signature from a response, started a new session and asked Claude to turn the signature back into the full trace.
Alibaba’s campaign alone was more than six times the size of the next largest, and each of these distillation attacks leaned on reasoning traces.
The windows differ, so the bars compare reported totals rather than rates. DeepSeek’s 12.1 million came in just 14 days.
Why reasoning is the prize in distillation attacks
Visible reasoning is valuable to a distiller because it shows how a model reaches an answer, not only the answer itself. That is why Anthropic keeps it hidden. On Claude Fable 5 and Mythos 5, the release notes say, “The raw chain of thought is never returned”. Thinking display defaults to "omitted", and developers who want to read it get summaries.
A prompt that tells Claude to write its reasoning into the answer text is an attempt to get around that design. That is why Anthropic treats it as part of distillation attacks rather than as an ordinary request. The reasoning_extraction code turns that judgement into a billing rule. Before 24 September, a distillation pipeline whose prompts were blocked paid nothing for the blocks. Now each one is charged at the input rate of the model that refused it.
What Blocked Distillation Attacks Cost at Claude's List Prices
Anthropic has not put a figure on the new charge, but its documentation gives enough to work one out. A refusal before any output has zero output tokens. The billed amount is therefore the request’s input tokens multiplied by the refusing model’s input price.
One refusal, four models
The example refusal in the documentation reports 412 input tokens and 0 output tokens. The table prices that refusal on each model that runs the classifiers, using the base input prices on Anthropic’s pricing page.
| Claude model | Base input price | One 412-token billed refusal | One million such refusals |
|---|---|---|---|
| Fable 5.1 | $10 per million tokens | $0.00412 | $4,120 |
| Fable 5 | $10 per million tokens | $0.00412 | $4,120 |
| Opus 5 | $5 per million tokens | $0.00206 | $2,060 |
| Opus 5.5 | $4 per million tokens | $0.001648 | $1,648 |
At that size, a single refusal costs less than half a cent. The charge only matters at volume, which is the point. A developer who hits a billable block a few times a month will not notice it. A pipeline sending millions of blocked requests will.
Longer prompts cost more
Real prompts are rarely as short as the example. Agent sessions carry system prompts, tool definitions and conversation history, and all of it counts as input. The cost of a blocked request rises in step with the size of the prompt, so distillation attacks that pad every request with a long fixed instruction pay more per block.
For scale, if every one of the 151 million exchanges the September report attributes to Alibaba had been a 412-token billed refusal on a $10 model, the charge would have come to about $622,000. That is only an illustration. Those campaigns ran against Opus 4.6 and 4.7 before this rule existed, and an exchange that returns an answer was always billed. Distillation attacks already paid for every answer they harvested. What was free until this week was the blocked attempt.
Who actually pays for blocked distillation attacks
There is a catch in charging attackers. The September report says illicit distillation “is typically enabled by fraud: sophisticated networks of fake accounts created with stolen credit cards, login credentials, and API keys.” It adds that proxy services “will often use stolen API credentials belonging to legitimate companies or individuals”, and that “These fraudulent activities harm legitimate customers.”
If a blocked request runs on a stolen key, the charge lands on the key’s real owner. The charge still helps Anthropic, because a stolen card or key with a spending limit runs dry faster. But it is not a cost that distillation attacks necessarily bear themselves. Companies should treat an unexpected run of bio, frontier_llm or reasoning_extraction refusals in their usage data as a possible sign that a key has leaked, and check it alongside their wider cybersecurity monitoring.
An open question on cached prompts
The documentation says billed refusals are charged “like any other request”. It does not work through the case of a prompt whose prefix is already cached. Alibaba’s pipeline, as the report describes it, “injected a fixed prompt into each request”, which is exactly the kind of repeated prefix prompt caching is built for. On Claude Fable 5.1, cache reads cost $0.25 per million tokens, a fortieth of the base input price.
If a refused request bills cached input at cache-read rates, as an ordinary request would, a pipeline built around a fixed cached prefix would pay far less per block than the table suggests. Anthropic has not said whether that is how it works.
Reading the 99.7% and 0.1% Figures on Distillation Attacks Blocks
Anthropic backed the change with two numbers. They measure different things, and neither tells an individual developer whether a particular block was right. Both are worth reading closely before assuming the billed categories will never touch legitimate work.
99.7% of accounts means 3 in 1,000 were affected
The first figure says 99.7% of accounts using Claude Code, Claude.ai or Cowork “did not hit any of these newly ‘billable blocks'” in recent testing. Put the other way round, 0.3% did. That is 3 accounts in every 1,000, or 300 in every 100,000. The post does not say how long the test ran, how many accounts it covered, or how the blocks split between biology, frontier LLM development and distillation attacks.
It also counts accounts rather than requests, so an account that hit one block counts the same as one that hit a thousand. And the three surfaces it names are Anthropic’s own apps, while the billing rules in the documentation are written for the API platforms. Anthropic has not said how a billable block will be counted on a Pro or Max subscription, where there is no per-token invoice.
A false positive rate below 0.1% is a tuning target
The second figure says the classifiers behind the billed categories “are tuned to have a <0.1% false positive rate”. A false positive is a benign request blocked in error. Below 0.1% means fewer than 1 benign request in 1,000 is blocked by mistake, or fewer than 100 in every 100,000. Anthropic added: “We know that’s not 0%.”
A rate is an average across all traffic. It cannot say whether a given block was justified, and errors can cluster in particular kinds of work. The documentation itself warns that “Beneficial life sciences work” can trigger bio, and that “Benign machine learning work” can trigger frontier_llm. Teams whose everyday work sits close to biology or model training are the most likely to find the 0.1% concentrated on them.
How far the classifiers have come since June
The two figures look very different from those Anthropic gave at launch. On 9 June it said Fable 5’s classifiers triggered “on average, in less than 5% of sessions”, and that “more than 95% of Fable sessions involve no fallback at all”. On 7 August it announced changes to Fable 5’s biology safeguards “in a way that substantially reduces false positives”, saying biology-related fallbacks fell by about 85% in testing.
The biology update did most for the consumer app and least for developers on the Claude Platform, according to Anthropic’s own estimates.
The 7% figure for the Claude Platform stands out. The platform is where the new charges appear on an invoice, and it is where most refusals had nothing to do with biology. For developers there, the error rates that matter are those of the classifiers that catch distillation attacks and frontier model work. Anthropic has published no separate figures for either beyond the blanket 0.1%.
Who Is Most Exposed When Distillation Attacks Are Blocked
The new charges are aimed at distillation attacks and biology misuse, but a classifier sees intent only through the text of a request. Four groups of legitimate users are the most likely to run into billed blocks as a side effect of the rules written for distillation attacks.
Machine learning researchers and model builders
frontier_llm is the widest trap for honest users. Evaluating models, generating synthetic data, writing training code and comparing architectures are all routine work, and all sit close to “the development of competing AI models”. Anthropic’s terms allow such use only “as expressly approved by Anthropic”.
Our look at Garry Tan’s call for an American distillation regime found no published path for getting that approval. The classifiers built for distillation attacks cannot easily tell an evaluation harness from a distiller’s pipeline, since both send large volumes of structured prompts. Teams doing ML model development on Claude should check where their work stands before billed blocks appear.
Life sciences teams
For biology there is now a formal route out. On 17 September Anthropic opened applications to its Life Sciences Verification Program. It gives verified teams “access to our Mythos, Opus, and Sonnet models with a refined set of safeguards more permissive for biology-related work”. Standard Use grants cover Mythos 5.1, Opus 5 and Sonnet 5 and are renewed once a year, while “High-risk Use” grants exist for more sensitive work. The program launched in beta for teams and institutions, with access for individual Pro and Max plans promised “over time”.
Anyone who asks Claude to show its working
The reasoning_extraction classifier looks for requests that ask Claude “to reproduce its internal reasoning in the response text”. Plenty of ordinary prompts ask for step-by-step explanations. Anthropic’s guidance is to use adaptive thinking instead of asking for reasoning in the answer text. Prompts written for older models are worth reviewing, because the documentation does not say where the line falls between an explanation and an extraction attempt.
Early user reports suggest the line can be hard to see. One Hacker News user wrote on 23 September that Anthropic’s Opus 5.5 refused a code-review task, and that another model explained “it had the word ‘reasoning’ in it”. Another, replying to the billing news, said a block had flagged “Use Unicode graphemes” as biology. These are individual accounts, not measurements, but they show why billed categories make false positives costlier than before.
Agent builders
Agents multiply refusals. The documentation warns that “A single turn can produce several refusals, for example an agent plus its sub-agents”, and that the fallbacks parameter “does not propagate into model calls made from inside tool execution”. An agent that retries a blocked step on the same model, or whose sub-agents each hit the same block, will pay for every attempt in a billed category. The categories were chosen with distillation attacks and biology in mind; agents simply make refusals more frequent. Our explainer on how AI models decide not to answer covers why that happens.
How Fallback Billing Works Alongside Distillation Attacks Charges
Most developers will meet billed refusals through fallback, Anthropic’s mechanism for retrying a declined request on another model. The fallback rules did not change on 24 September. They do now interact with the new charges, including those aimed at distillation attacks, and the combination is easy to misread.
Server-side fallback
On the Claude API, setting fallbacks to "default" with the server-side-fallback-2026-07-01 beta header makes the API retry a refused request on “the fallback model Anthropic recommends for its refusal category”. The documentation’s example shows a request to Claude Fable 5 served by Claude Opus 4.8. “For categories with no recommended fallback, the refusal stands.” Developers can instead name up to three fallback models of their own.
At Fable 5’s launch, Anthropic said requests flagged as part of distillation attempts would fall back to Opus 4.8 in its products. So a blocked request in a category tied to distillation attacks can still be answered by another model where a fallback exists, and both attempts are billed. The SDK middleware gives the same behaviour on Amazon Bedrock, Google Cloud and Microsoft Foundry, where the server-side parameter is not available.
The refusal is billed as well as the retry
The key sentence sits in the billing section: “When you use fallback, the refusal that triggered it is billed, in addition to the fallback request, when it arrived mid-stream or is in one of the billed categories.” A blocked bio request that falls back to Opus 4.8 now costs the refused attempt’s input tokens plus the whole fallback request. Each attempt is billed at the rates of the model that ran it, and “Every attempt that runs, including one that declined, counts against its own model’s rate limits.”
Fallback credit and sticky routing
Two features limit the double cost. The first is fallback credit. Prompt caches are per model, so a retry on a new model would otherwise have to write the cached conversation again. With the credit, the retry “is billed as though the conversation had been on the new model all along”. Server-side fallback and the SDK middleware apply it automatically; a retry built by hand has to redeem it.
The second is sticky routing. After a conversation falls back, the API records which model served it for “approximately 1 hour”, scoped to the organisation, and sends later turns straight to that model. It stores “a content hash of the conversation prefix plus the model that served it”, not the messages themselves. The documentation calls it best-effort, so code must still handle the original model being tried again.
| Case, from 24 September 2026 | Refused attempt billed? | Anything else billed | Rate limits |
|---|---|---|---|
Pre-output refusal, cyber, general_harms or null, no fallback | No | Nothing | Counts |
Pre-output refusal, bio, frontier_llm or reasoning_extraction, no fallback | Yes, input tokens at the refusing model’s rates | Nothing | Counts |
| Pre-output refusal in a billed category, with fallback | Yes | The fallback request, with fallback credit covering the cache miss | Each attempt counts against its own model |
| Pre-output refusal in an unbilled category, with fallback | No | The fallback request | Each attempt counts against its own model |
| Mid-stream refusal, any category | Yes, input tokens plus output already streamed | Any fallback request | Counts |
What Developers Should Change Before the Next Invoice
None of this requires code changes to keep working. It does require some changes to avoid paying for blocks without noticing. The documentation’s own list of common pitfalls is the best place to start, and each point below comes from it or from the billing rules.
Treat refusals as their own metric
“A refusal is an HTTP 200,” the documentation says, “so monitoring built on error rates or 5xx responses never sees it.” Check stop_reason on every response. Branch on stop_reason or stop_details.type rather than on content or the inner fields, because category and explanation can both be null.
Log the category and every attempt
Store stop_details.category, the model, the token counts and the request ID for each refusal. When fallback is on, the usage.iterations array is “the per-attempt record of what you’re billed”; the top-level usage describes only the attempt that produced the returned message. Separate billed-category refusals from free ones, so that a spike in bio, frontier_llm or reasoning_extraction blocks shows up before the invoice does, whether the cause is distillation attacks on a leaked key or an over-eager classifier.
Do not retry on the same model
“Re-sending a refused request to the same model usually earns another refusal,” the documentation warns. In a billed category, each of those refusals is now charged. Retry on a fallback model instead, budget retries per request rather than per turn or session, and give sub-agent calls their own fallback configuration.
Move reasoning requests to adaptive thinking
If your prompts ask Claude to explain its reasoning inside the answer, test them against the reasoning_extraction classifier. Anthropic’s suggested route is adaptive thinking, which returns reasoning in thinking blocks rather than asking Claude to reproduce it as text. That keeps legitimate products away from the category used to catch distillation attacks.
Report false blocks and keep records
Claude Code users can report a wrong block with /feedback. Neither the post nor the documentation says how, or whether, Anthropic will refund a charge for a block that proves to be wrong. Keep the request ID, the category, the prompt and the token counts for any block you dispute, since a support request will need them. Organisations weighing how Claude fits into their stack can talk to our AI strategy team.
Will Charging for Blocks Deter Distillation Attacks?
The billing rule is small, but it closes a gap that suited distillation attacks well. Whether it changes their economics depends on who pays and how much of their traffic is blocked. The answer is less clear-cut than the announcement suggests.
The case for pricing distillation attacks
Distillers were already paying for every exchange that returned an answer. The one free activity was a blocked attempt. A pipeline that probes Claude’s classifiers, adjusts its prompts and tries again could do that at no token cost, and, for at least part of the summer, without touching its rate limits either. Charging for blocks in the categories distillation attacks rely on puts a price on that trial and error. Anthropic calls it “one layer of defense”, not a solution.
The limits of a price
The same reports that justify the charge also suggest its limits. Distillation campaigns run on stolen cards and stolen keys, so part of the cost will land on fraud victims rather than on the labs. The largest campaign in the September report peaked at nearly 3 million exchanges a day. At the documentation’s 412-token example size, even 3 million billed blocks a day on a $10 model would cost about $12,360 a day.
That is a real cost, but a small one next to the value of a frontier model’s capabilities. Against distillation attacks, the charge makes most sense alongside the other defences Anthropic listed in February: classifiers and fingerprinting, intelligence sharing with other labs and cloud providers, tighter account verification, and product-level countermeasures. For how Anthropic’s newest models fit together, see our guide to the Claude 5 family and our report on the Fable 5.1 and Mythos 5.1 launch.
What Anthropic has not said
Several questions are still open after the announcement:
- which “coordinated attacks on our systems in recent weeks” prompted it, and whether they were distillation attacks, biology probing or both;
- how a billable block is counted on consumer subscriptions such as Pro and Max, where there is no per-token bill;
- whether customers can get a refund for a block that proves to be a false positive, and how;
- how cached prompt prefixes are priced on a refused request;
- when refusals before any output started counting against rate limits.
Frequently Asked Questions About the Distillation Attacks Charge
Does Anthropic charge for every refused request now?
No. A refusal before any output is billed only when its category is bio, frontier_llm or reasoning_extraction. Refusals in cyber or general_harms, or with no category, are still free. Mid-stream refusals were already billed and still are. The three billed categories cover biology and two kinds of distillation attacks.
How much does a billed refusal cost?
It is billed like any other request, at the rates of the model that ran it. Because no output is generated, that normally means input tokens only. A 412-token refusal costs $0.00412 on Claude Fable 5.1 and $0.001648 on Opus 5.5.
Which category covers distillation attacks?
The X post names distillation attacks as a billed category. In the API, the matching code is reasoning_extraction, used when a request asks Claude to reproduce its internal reasoning in the response text. The frontier_llm code, for requests that could help build competing models, also targets distillation.
Does the change apply outside the Claude API?
Yes. The release note says it “applies on all platforms”, and the documentation lists the Claude API, Amazon Bedrock, Claude Platform on AWS, Google Cloud and Microsoft Foundry. Anthropic’s apps, Claude Code, Claude.ai and Cowork, were the basis of its 99.7% figure, but it has not said how blocks are charged on subscription plans.
What should I do if I think a block was wrong?
In Claude Code, report it with /feedback. Keep the request ID, category and token counts. Anthropic has not published a refund process for billed false positives.
Why did Anthropic stop charging for refusals in the first place?
It stopped on 2 June 2026, a week before Claude Fable 5 launched with classifiers it had tuned conservatively. Not billing refusals kept the cost of false positives off customers while the classifiers were at their strictest. It is now restoring the charge only where it says false positives are rare, and where distillation attacks and biology misuse are the targets.
References and Further Reading
Resuming charges for requests blocked by safeguards (@ClaudeDevs on X)
Refusals and fallback (Claude Platform documentation)
Claude Platform release notes (Anthropic)
Fallback credit (Claude Platform documentation)
Fable 5 fallback and billing guide (Claude Cookbook)
Update billing text for pre-stream refusal billing (anthropics/claude-cookbooks on GitHub)
Pricing (Claude Platform documentation)
Detecting and preventing distillation attacks (Anthropic)
Threat Intelligence Report, September 2026 (Anthropic)
Claude Fable 5 and Claude Mythos 5 (Anthropic)
Redeploying Fable 5 (Anthropic)
Improving Fable 5’s biology safeguards (Anthropic)
Introducing the Life Sciences Verification Program (Anthropic)
Commercial Terms of Service (Anthropic)
Anthropic resumes charging for requests blocked by safeguards (Hacker News)
Anthropic Now Charges Developers for Claude’s Blocked Safety Refusals (AlphaSignal)
More AI coverage: explore Progressive Robot's AI Models, Tools & Releases hub — hands-on reviews, setup guides and benchmarks in one place.
