AI Catchup

Anthropic Resumes Billing for Claude Refusals Before Output in Three Safeguard Categories

By 6 min read

Anthropic resumed billing for Claude requests refused before any output when its safeguards classify them as biology, frontier LLM development, or reasoning extraction. The charge uses the model's normal rates across platforms. Other pre-output refusals remain unbilled, but still count against rate limits.

Anthropic has resumed billing for Claude requests that its safeguards refuse before any output. A September 24 post from Anthropic's approved ClaudeDevs account says the change covers biology, distillation attacks, and frontier LLM development, which it describes as categories with low false-positive rates. Anthropic's current refusal and fallback documentation maps the billed API categories to bio, frontier_llm, and reasoning_extraction and says the rule applies on every supported platform.

Key Takeaways

  • A blocked request can now be billable before Claude generates text. The change applies when stop_details.category is bio, frontier_llm, or reasoning_extraction. (Anthropic API release notes)
  • The charge is the model's normal rate. Anthropic says billed refusals are charged like any other request, at the rate of the model that ran it. (Anthropic refusal and fallback documentation)
  • The rule applies across platforms. Anthropic lists the Claude API, Amazon Bedrock, Claude Platform on AWS, Google Cloud, and Microsoft Foundry. (Anthropic refusal and fallback documentation)
  • Not every refusal is billed. Pre-output refusals in other categories, or with a null category, remain unbilled, although the request still counts against rate limits. (Anthropic refusal and fallback documentation)
  • Fallback credit did not change. Each model attempt follows its own refusal-billing rule, and the fallback request is billed separately when it runs. (Anthropic API release notes)

What Changed

Anthropic's API release notes say it is resuming billing for refusals that arrive before any output when stop_details.category is bio, frontier_llm, or reasoning_extraction. The notes say these are the categories in which Anthropic measures low volumes of false positives, and that refusals in other categories remain unbilled. (Anthropic API release notes)

The change reverses the earlier API behavior in which a refusal before any output was not billed. It does not make every safety refusal billable, and it does not change the model price. A billed refusal uses the normal input and output rates for the model that handled the request, even though the response contains no generated content. (Anthropic API release notes; Anthropic refusal and fallback documentation)

Anthropic's ClaudeDevs announcement uses the phrase distillation attacks for one of the covered areas. The API documentation uses reasoning_extraction for a category involving requests to reproduce internal reasoning, and its release notes describe the related restriction as reverse engineering or duplicating model outputs. The documentation is the safer reference for deciding how an API response is categorized. (ClaudeDevs on X; Anthropic API release notes)

Which Categories Are Billable

stop_details.categoryWhat Anthropic's docs sayBilled before any output
bioThe request could enable biological harm, such as dangerous lab methods.Yes
frontier_llmThe request could assist development of competing AI models, which Anthropic restricts under its commercial terms.Yes
reasoning_extractionThe request asks the model to reproduce internal reasoning in response text.Yes
cyberThe request could enable cyber harm, such as malware or exploit development.No
general_harmsThe request falls under another usage-policy harm area.No
null or another categoryNo billed category is identified.No

Anthropic says benign work can still trigger the bio and frontier_llm categories, and that the billed categories may change as it measures and refines its safeguards. Treat the table as the current documented behavior, not as a permanent pricing promise. (Anthropic refusal and fallback documentation)

Platform Scope and Fallback

The billing rules apply on the Claude API, Amazon Bedrock, Claude Platform on AWS, Google Cloud, and Microsoft Foundry. Anthropic says the refusal is billed at the rate of the model that ran it, while a fallback attempt is billed separately according to the model and attempt that serves the response. (Anthropic refusal and fallback documentation)

Fallback credit remains unchanged. Anthropic describes it as compensation for the fallback request's prompt-cache miss, so an application does not pay to cache the conversation twice. The usage.iterations array records each attempt, and each attempt counts against its own model's rate limits. (Anthropic refusal and fallback documentation)

The rule also distinguishes refusals that arrive before output from refusals that happen after output has started. A mid-stream refusal was already billed for the input tokens and output that had streamed, so this update mainly changes the treatment of selected refusals that previously produced no output. (Anthropic API release notes; Anthropic refusal and fallback documentation)

What Developers Should Do

Log stop_details.category. Do not infer billability from the fact that a request was refused. The category is the field Anthropic documents for distinguishing the three billed pre-output refusals from other refusals that remain unbilled. (Anthropic refusal and fallback documentation)

Audit fallback attempts separately. If your integration retries on a recommended fallback model, record each attempt and its model. A billed refusal and the fallback response can appear as separate model attempts, with separate rate-limit and usage implications. (Anthropic refusal and fallback documentation)

Budget for false positives in benign work. Anthropic explicitly says beneficial life-sciences work and benign machine-learning work can trigger the bio and frontier_llm categories. Add a review path for legitimate requests rather than assuming a refusal means the request was malicious. (Anthropic refusal and fallback documentation)

Re-check the docs before hard-coding policy. Anthropic says the billed categories may change as it measures false-positive rates. Store the category and response metadata so your billing analysis can be updated when the policy changes. (Anthropic refusal and fallback documentation)

Why Anthropic Made the Change

The ClaudeDevs post says Anthropic saw coordinated attacks on its systems and is using billing as one layer of defense. Anthropic's September 2026 threat intelligence report documents coordinated distillation campaigns, fraudulent-account pools, proxy infrastructure, and attempts to extract model reasoning. The report provides context for the policy, but it does not state the billing treatment of refused requests. (ClaudeDevs on X; Anthropic threat intelligence report)

Sources

Read next

Related coverage

Frequently Asked Questions

Which Claude refusals are now billed?

Anthropic's current documentation says a refusal before any output is billed when stop_details.category is bio, frontier_llm, or reasoning_extraction. Anthropic describes these as categories with low measured false-positive volumes.

Are all Claude refusals billed?

No. Pre-output refusals in other categories, including cyber, general_harms, and a null category, remain unbilled. They still count against rate limits.

How much does a billed refusal cost?

Anthropic says a billed refusal is charged like any other request, at the normal rate of the model that ran it. The rule applies on the Claude API, Amazon Bedrock, Claude Platform on AWS, Google Cloud, and Microsoft Foundry.

Does fallback change the billing?

The refusal attempt follows the category rule, and the fallback attempt is billed separately at the rate of the model that serves it. Anthropic says fallback credit is unchanged.

What should developers monitor?

Inspect stop_details.category on refusal responses and usage.iterations when using fallback. The category tells you whether a pre-output refusal is billable, while usage.iterations records each model attempt.

Get the weekly AI Catchup

Tools, practices, and what matters, in your inbox every week.