Anthropic stopped charging for Claude Code's safety classifier — unless your LLM gateway drops one request field

The one-line release and the documentation page that gives it away

The changelog entry for Claude Code 2.1.278 is a sentence. Auto mode for Claude API and Enterprise users now defaults to the server-side classifier, “which does not charge for classifier overhead,” plus a new /status row showing whether the session’s classifier runs server-side.

Shipped alongside it: a dedicated documentation page titled Auto mode classifier request charges, whose subtitle is about resolving a notice telling you that your session isn’t eligible. Vendors do not write troubleshooting pages for features that work. The page exists because Anthropic knew, before release, that a large number of its paying customers would hit the unhappy path — and it is worth reading the whole thing, because it is unusually candid about what that path costs.

Here is the mechanism. When auto mode became the default on 14 August, it replaced the permission prompt with a second model that screens shell commands, network calls and agent messages before they execute. On Pro, Max and Team plans Anthropic ate the cost of those screening calls. Everywhere else — the API, Enterprise, and every cloud provider — they were billed as ordinary token usage, because each one sends a slice of the transcript plus the pending action to a model for review.

From 2.1.278, Claude Code asks the server to fold those checks into the session’s own model requests instead, and does not bill for them. That is a real, unambiguous price cut on a safety feature, and it deserves to be recorded as one.

Eligibility is a network fact, not a plan entitlement

The interesting part is what determines whether you get it.

Not your plan. Not your contract. Not your region, mostly. What decides it is whether the request that leaves your machine and the response that comes back survive the journey unmodified.

Anthropic’s own words:

When the server’s checks can’t reach your session, Claude Code keeps using its own classifier requests instead, and those requests are billed as they were before.

And on the cause:

The most common cause is an LLM gateway or proxy between Claude Code and the API: one that strips or rewrites request headers, drops request fields it doesn’t recognize, or edits responses, for example by rewriting IDs or dropping keys from streaming events.

That is a description of most corporate LLM gateways. Routing every model call through a central proxy for logging, cost attribution, key custody, PII redaction and policy enforcement is the standard enterprise pattern — it is what a platform team is supposed to build. And the design instinct of nearly every such proxy is to normalise: parse the request into a known schema, drop what it does not recognise, reconstruct the response with the headers it knows about. That instinct is precisely what breaks this.

The specific contract is narrow enough to state in full. The gateway must forward the safeguards request body field it has never heard of, forward the anthropic-beta header verbatim rather than allowlisting values, and return the safeguard_results response field and streaming event keys without dropping or rewriting them. Anthropic’s gateway guide is blunt about the general rule: treat headers and body fields as open lists, because “a gateway pinned to an observed list strips the next capability’s header or field and breaks it on the release that introduces it.”

Gateways fail loudly on function and quietly on money

This is the part that generalises past one release, and it is the reason this is worth your attention rather than a config note.

Read Anthropic’s own feature pass-through table and sort it by failure mode. Context management, beta tool fields, effort and structured outputs all pair a beta header with a body field, and when a gateway forwards one half without the other the result is a hard 400. Somebody’s build breaks, somebody files a ticket, somebody fixes the gateway. The system is self-correcting because the failure is loud.

Now look at the two rows that do not error. Prompt caching: a gateway that converts block-form system content to plain strings or drops cache_control markers produces no error — the conversation simply “bills as uncached input on every turn.” Token counting: no error, Claude Code just falls back to a character-based estimate. And now classifier billing joins them: no error, auto mode keeps working perfectly, and you keep paying for something that became free.

The pattern is consistent. When a lossy middlebox breaks a capability, you find out immediately. When it breaks an economy — caching, metering, a waived charge — you find out at invoice time, if ever. Nothing in the stack is instrumented to notice that a bill failed to go down.

This is the third time in five weeks that the metered surface of an agent has turned out to be somewhere other than where buyers were looking. Anthropic’s on-demand compaction changed which usage fields were the bill. Claude Code’s weekly limits were cut against a base that was never published. Projects shipped with Opus at high effort as the thread default. In every case the headline capability was fine and the accounting moved underneath it.

It is already happening

Within a day of the release, issues opened against third-party gateway and router projects describing exactly this. The clearest is 9router #4196, filed 20 September: users see the ineligibility notice naming the gateway, classifier requests keep being charged, and the maintainers’ own diagnosis is that the router replaces the client’s anthropic-beta header instead of unioning it, discards unknown request body fields such as safeguards during translation, and reconstructs responses with a fixed header set so upstream headers never reach the client. Similar reports landed against local-routing switchers and self-hosted proxy projects the same day.

None of this is a defect unique to those projects. They implemented the reasonable thing — a pinned allowlist — and the reasonable thing is wrong here. Anyone who has built an internal proxy on the same instinct should assume they are in the same position until /status says otherwise.

What to check this week

Run /status in an auto-mode session on every path you use. The Auto mode server row reads Enabled or Disabled. Do it once from a developer laptop on the direct API, once through the corporate gateway, and once on each cloud provider you route to. This takes ten minutes and is the entire diagnostic.

Treat a named-gateway notice as a platform ticket, not a developer annoyance. The 24-hour acknowledgment window means the first person to hit it will press Enter and never see it again, and nobody upstream will learn that a fleet is on the billed path. If your gateway is in the path, ask for the pass-through fix explicitly: union the beta header, preserve unknown body fields, forward upstream response headers.

Do not reach for CLAUDE_CODE_AUTO_MODE_SERVER=0 first. It suppresses the notice and locks you onto billed classifier requests. It is the right call only when the gateway genuinely cannot be fixed, and even then it is temporary by Anthropic’s own description.

If you are on Bedrock, Agent Platform or Foundry, check your model list too. Auto mode works there only on Claude Sonnet 5, Opus 4.7 or later, and the Fable models. A pinned older model means no auto mode at all, which makes the billing question moot and raises a different one.

Measure before and after. Compare per-session cost on a representative tool-heavy workload across an eligible path and your gateway path. That number, not a blog post, tells you what the gateway fix is worth.

The pattern

Buying an AI coding agent used to mean evaluating a model and a price. It now means evaluating a model, a price, a harness, a set of defaults, and — as of this week — the fidelity of every piece of middleware between your developers and the endpoint.

That last item has no owner in most organisations. The platform team that runs the gateway measures it on uptime and policy coverage; nobody measures it on protocol faithfulness, because until recently there was no such thing as a request field whose removal costs money. There is now, and there will be more, because this is how vendors are choosing to negotiate capabilities: new body fields, new beta values, new response keys, all of which a normalising proxy eats by default.

The same logic showed up in a different coat when Grok 4.6 arrived on Bedrock at a different price than the first-party endpoint — the channel you buy through is now a pricing variable, not just a paperwork one. The difference is that a price list is visible. A dropped header is not.

For developers comparing harnesses, this does not move the coding tools shortlist or change the Cursor versus Claude Code calculus, and it should not. Anthropic made a thing cheaper and documented the exception honestly, which is more than the category usually manages. But it added one question to every enterprise Claude rollout that nobody had on the list: does our gateway pass through fields it has never heard of?

If the answer is no, you are paying for the safety net that everyone else stopped paying for — and the product will not tell you again after the first day.

Questions or corrections? Email Pick Right. Want the full list? See all news.