What changed
ClaudeDevs said on 24 September 2026 that Anthropic would resume charging for requests its safeguards block before Claude responds. The post called the charge one layer of defense after coordinated attacks on Anthropic’s systems in recent weeks.
ClaudeDevs limited the resumed pre-output charge to biology, distillation attacks, and frontier LLM development. Anthropic’s refusals-and-fallback docs bill a refusal that arrives before any output when stop_details.category is bio, frontier_llm, or reasoning_extraction, a rule the docs frame as a way to disrupt attempts to circumvent Anthropic’s safeguards at scale. The docs define reasoning_extraction as a request that asks the model to reproduce its internal reasoning in the response text, and they point people who want that reasoning in a structured form to adaptive thinking. ClaudeDevs’ distillation-attacks bucket is that billed category. For bio, frontier_llm, and reasoning_extraction, the docs state that Anthropic measures low volumes of false positives as of September 2026, and that the billed categories may change as Anthropic keeps measuring and refining those rates.
Who it hits, and what it costs
ClaudeDevs said recent testing found 99.7% of accounts using Claude Code, Claude.ai, or Cowork did not hit any of these newly billable blocks. ClaudeDevs said the classifiers behind the blocks are tuned to a false-positive rate under 0.1%, that the rate is not zero, and that they intend to keep improving the classifiers so they interrupt work less often.
The same billing rules apply on the Claude API, Amazon Bedrock, Claude Platform on AWS, Google Cloud, and Microsoft Foundry. A billed pre-output refusal is charged like any other request, at the rates of the model that ran it. A pre-output refusal in cyber, general_harms, or a null category is not billed. Either way, content is empty, token counts appear in usage, and the request still counts against rate limits. A mid-stream refusal bills the input tokens and the output already streamed at normal rates.
The docs state that bio, frontier_llm, cyber, and general_harms can also fire on beneficial or benign work in those domains. reasoning_extraction is billed when the request asks the model to reproduce its internal reasoning; adaptive thinking is the docs’ path for structured reasoning. For bio, frontier_llm, and reasoning_extraction, the docs say Anthropic measures low volumes of false positives as of September 2026.
| Category | What it covers | Billed before any output |
|---|---|---|
| bio | Could enable biological harm, such as dangerous lab methods. Beneficial life sciences work can also trigger this category. | Yes |
| frontier_llm | Could assist the development of competing AI models, restricted under Anthropic's commercial terms. Benign machine learning work can also trigger this category. | Yes |
| reasoning_extraction | Asks the model to reproduce its internal reasoning in the response text. Adaptive thinking is the structured alternative. | Yes |
| cyber | Could enable cyber harm, such as malware or exploit development. Benign cybersecurity work can also trigger this category. | No |
| general_harms | Falls under a usage-policy area outside the four named categories. Benign work can also trigger this category. | No |
| null category | The refusal does not map to a named category. | No |
How to respond
ClaudeDevs asked people who think a request was blocked incorrectly to report it with /feedback in Claude Code. A refusal is a successful HTTP 200 with stop_reason "refusal". Anthropic’s docs say you can usually get an answer by sending the same request to another Claude model. Server-side fallback is in beta on the Claude API; when you use fallback, the refusal that triggered it is billed in addition to the fallback request if it arrived mid-stream or if its category is bio, frontier_llm, or reasoning_extraction.
What remains unclear
Anthropic’s docs date the billed pre-output categories as of September 2026. They leave the pause and the resume undated. ClaudeDevs’ 99.7% account-hit figure and the under-0.1% false-positive rate appear in the post; the docs speak of low volumes of false positives. Claude Code’s changelog has a note that points the claude-api skill at this billing page and restates the mid-stream and rate-limit rules. The visible changelog note has no version header.
Source
Also from
Sources and editorial approach
Read the complete ClaudeDevs X post of 24 September 2026, the full extracted Anthropic Platform refusals-and-fallback article, and a truncated Claude Code changelog page. The changelog excerpt has no version header on the claude-api skill billing note. ClaudeDevs’ 99.7% and under-0.1% figures, the resume wording, and the keep-improving line appear only in the post; the docs state the billed-category set as of September 2026 and give the circumvent-safeguards-at-scale purpose.