Anthropic now bills refusals that return nothing — in the three categories where its own docs say benign work gets caught

The change, in one sentence

Anthropic’s platform release notes for 24 September 2026 record it plainly: the company is “resuming billing for refusals that arrive before any output when stop_details.category is "bio", "frontier_llm", or "reasoning_extraction", the categories where we measure low volumes of false positives.”

Until that date, a refusal that produced nothing was free. Claude’s safety classifiers had already read your input tokens, and Anthropic absorbed that cost. Now, in three categories, it does not. The refusal docs spell out the mechanics: these refusals “are billed like any other request, at the rates of the model that ran it,” and “either way, content is empty and token counts appear in usage. The request still counts against your rate limits.”

Start with the case for the change, because it is genuinely strong. Anthropic says it acted after observing coordinated attacks on its systems. A refusal that costs nothing is a probe that costs nothing, and an adversary trying to map the boundary of a classifier — or to extract capability through thousands of slightly varied attempts — has every incentive to keep firing. Metering that loop is a rational defence, and it is the same logic that prices any other abusable free resource. Anthropic also disclosed the change in its release notes and wrote it into the reference documentation with a dedicated table column rather than burying it. That is better behaviour than the industry baseline.

The question worth asking is not whether to bill probes. It is who else is standing in the blast radius.

One note for anyone triaging that release note as a whole: the billing change was not the only breaking item in it. The same 24 September entry also records that the Compliance API Activity Feed stopped returning filenames, project document names and artifact titles — retroactively, on events recorded months earlier. A team that reads the release note for pricing exposure and stops there will miss an audit-log change that affects a different function entirely.

The three categories, read against Anthropic’s own descriptions

Here is the category table as the documentation presents it, with the billing column intact:

Read the middle column and the right column together. For two of the three billed categories, Anthropic’s own one-line description contains an explicit warning that legitimate work sets them off. The company is not hiding this; it is documented in the same table as the price. But it means the new charge lands on a population that includes, by the vendor’s own account, computational biologists, drug-discovery teams, ML researchers, evaluation engineers and anyone fine-tuning or benchmarking models — the people whose prompts routinely read like the thing the classifier is looking for.

The third billed category is the odd one. reasoning_extraction is not a harm description at all. It describes a request that asks the model to write out its internal reasoning, and points you at adaptive thinking as the structured alternative. That is a prompt-hygiene note wearing a safety classifier’s uniform. Instructions of the form show your work and explain your reasoning step by step have been standard prompt-engineering advice for years and are embedded in system prompts, eval harnesses and agent scaffolds written long before preserved thinking existed. Those prompts now cost money to have declined.

There is a further asymmetry there. Anthropic’s default fallback routing carries documented recommendations for cyber, bio and frontier_llm, and the docs note that “for categories with no recommended fallback, the refusal stands.” So a reasoning_extraction refusal is billed, empty, and has nowhere to fall through to.

Fallback used to soften this. Now it compounds it.

This desk’s coverage of the Opus 5.5 launch set out the fallback economics as they stood on 22 September: a flagged request refuses visibly on the API, and if you opt into fallbacks: "default", the retry runs on a model Anthropic recommends for that category — Opus 4.8 for cyber, Opus 5 for bio and frontier_llm, both at $5/$25 against Opus 5.5’s $4/$20. The counterintuitive finding then was that the fallback costs more per token than the model you chose.

The 24 September change adds a second charge underneath the first. The refusal documentation now states: “When you use fallback, the refusal that triggered it is billed, in addition to the fallback request, when it arrived mid-stream or is in one of the billed categories.”

So a life-sciences team running Opus 5.5 with fallback enabled, on a request the bio classifier declines, now pays:

1. The refused Opus 5.5 attempt — input tokens at $4/MTok, zero output, empty response.
2. The Opus 5 fallback attempt — input at $5/MTok and output at $25/MTok.

Before 24 September, only line 2 existed. The usage.iterations array is the per-attempt record, and the docs are clear that “tokens from different models are never summed into one field” — which is precisely why a team watching only top-level usage counts will not see line 1 appear. That is the same class of measurement gap this desk flagged when Anthropic’s usage fields stopped describing the bill: the number your code reads and the number on the invoice have drifted apart again, in a new place.

One genuine mitigation ships alongside. Sticky routing records which model served a conversation after a fallback and sends later turns in that conversation directly to it, scoped to your organisation and retained for roughly an hour. The documentation’s stated purpose is to avoid “paying for an attempt that would predictably be declined again on every turn.” On a long flagged conversation, that is the difference between paying the refusal toll once and paying it on every turn.

But sticky routing arrives with server-side fallback, and server-side fallback is beta on the Claude API only — the docs note it “is not available on Amazon Bedrock, Google Cloud, or Microsoft Foundry.” The billing change, by contrast, “applies on all platforms.” Teams on Bedrock, Vertex or Foundry get the charge without the server-side mitigation and must configure the SDK middleware for client-side fallback instead. That asymmetry is worth a line in a platform-selection memo.

What the 99.7% figure measures

Anthropic’s public reassurance is that 99.7% of Claude Code, Claude.ai and Cowork accounts encountered none of these newly billable blocks during testing. Taken at face value, that is a low number and a fair thing to publish.

It also measures the wrong population. Claude.ai and Cowork are subscription products; a user there is not billed per token and cannot receive a refusal charge in the sense this change creates. Much Claude Code usage likewise runs on a subscription plan rather than metered API billing. The change applies to metered requests — on the Claude API and on all three partner clouds. So the denominator is dominated by accounts that the mechanism does not reach, and it is silent on the accounts it does: API organisations, whose traffic skews toward exactly the specialised technical workloads the three billed categories exist to catch.

The figure a buyer would need is the per-category false-positive rate on API traffic, and it has not been published. Nor has a refund path for a block that turns out to be wrong. The reporting on the change has converged on this same gap: without a refusal frequency, a false-positive rate, or an estimate of monthly impact, a developer cannot price the change before adopting it.

This is the recurring shape of 2026 pricing. The rate card is not where the cost lives. It lives in a default, a classifier threshold, or a billing rule in a docs page — the same pattern as effort defaults doing the work a discount was credited for, a cache-read cut that only pays out on the right workload shape, and a classifier that is free until a gateway drops a field.

The structural read

Two years of frontier-model safety policy have converged on a pattern this desk has tracked repeatedly: the rate card buys you a restricted model, and full capability is a clearance rather than a line item. Life sciences work runs through a verification programme with its own retention terms; capability tiers across the frontier labs are now gated by access programmes rather than price; independent evaluation itself has become a funded relationship rather than an open one.

What changed on 24 September is that the unverified state acquired a price. Previously, being on the wrong side of a classifier cost you capability and round trips. Now, in three categories, it costs capability, round trips and money — and the meter runs whether the classification was right or wrong. That asymmetry is the whole of the objection. An abuser and a misclassified researcher pay identical amounts, and only one of them has a way to stop paying.

None of which makes the change wrong. Metering a probe loop is defensible, and 0.3% is a real number even if it describes the wrong denominator. The reasonable position is narrower: a charge that lands on false positives should be accompanied by a published false-positive rate and a refund path, and at the moment it is accompanied by neither.

What to do

Measure your actual exposure before reacting to it. Query your logs for stop_reason: "refusal" across the last 90 days, group by stop_details.category, and price the input tokens in the three billed categories at your model’s input rate. Most teams will find a number in the low single-digit dollars. Knowing that is worth more than assuming it, and it is the same discipline — cost per completed task, not cost per million tokens — that every other 2026 pricing change has demanded.

Fix reasoning_extraction in your prompts, not your budget. Grep system prompts, agent scaffolds and eval harnesses for instructions asking the model to narrate its reasoning in the response text, and move to adaptive thinking. This is the one billed category where an edit removes the exposure outright, and it is invisible until someone goes looking. Teams running Claude Code or custom harnesses on top of the Claude API should treat this as a one-hour audit.

Branch on stop_reason, and read usage.iterations. A refusal is an HTTP 200 with an empty content array. Code that branches only on content length sees a silent null result, and code that reads only top-level usage will not see the refused attempt it just paid for. Both are now billing bugs as well as correctness bugs — a point that applies to any developer shipping against a classifier-gated model, and one worth weighing when comparing Claude against ChatGPT for a workload that sits near a policy boundary, since OpenAI’s cyber-tier models gate capability by programme too.

Treat the billed-category column as a variable. The documentation says outright that the set “may change as Anthropic keeps measuring and refining its safeguards’ false positive rates.” cyber and general_harms are free today because the measured false-positive volume is higher, not because they are exempt in principle. Anyone budgeting security or general-purpose work on the assumption that refusals are free is budgeting against a configuration setting, not a commitment.

Questions or corrections? Email Pick Right. Want the full list? See all news.