Anthropic makes three Claude refusal categories billable

Anthropic plans to charge for requests blocked before Claude produces output when its classifiers assign one of three labels: biology safety, model-distillation attacks, or frontier LLM development. The ClaudeDevs announcement attributes the change to coordinated attacks observed in recent weeks, with billing intended to raise the cost of automated probing.

• Scope: Qualifying pre-output refusals will incur token charges even when the response contains no generated content.
• Unchanged: Pre-output refusals are not billed for tokens, but the request still counts against rate limits.
• Timing: The announcement says charging “will resume” but gives no exact effective date.

Three classifier labels trigger charges

The billing decision depends on the classifier category returned with the refusal. A legitimate request can therefore incur a charge if the classifier produces a false positive.

Cybersecurity and broader general-harm categories are excluded from the newly billable group. Anthropic has not published a complete prompt-level taxonomy for the three included categories, so the classifier response remains the clearest record of why a request was charged.

HTTP 200 hides the refusal

Anthropic’s refusal documentation defines a classifier decline as a successful HTTP 200 response. The message contains an empty content array, a stop_reason of "refusal", and usage figures for the request.

{
  "stop_reason": "refusal",
  "stop_details": {
    "type": "refusal",
    "category": "bio",
    "explanation": "This request was declined..."
  },
  "usage": {
    "input_tokens": 412,
    "output_tokens": 0
  }
}

Under the existing default, Anthropic reports the input-token count for a pre-output refusal without charging for it. The new carve-outs make that input usage billable when the returned category matches one of the three labels. Output usage remains zero when no content was generated.

Mid-stream refusals follow a separate rule. Anthropic charges for the input and any output already streamed before generation stopped. Both pre-output and mid-stream refusals count against rate limits.

The economics behind the change

Repeated probes are cheaper when rejected requests carry no token cost. Charging for each attempt increases the budget required for automated jailbreaks, model extraction, and other coordinated campaigns. Anthropic describes the policy as one layer of defense rather than a replacement for classifiers or rate limits.

Anthropic reported that 99.7% of accounts using Claude Code, Claude.ai, or Cowork encountered none of the affected blocks during recent testing. It also said the relevant classifiers were tuned below a 0.1% false-positive rate.

The two figures measure different outcomes. The first tracks how many tested accounts encountered a block; the second estimates how often legitimate requests were classified incorrectly. The announcement provides no sample size, testing period, workload distribution, or category-level breakdown.

Each false positive can now create a direct charge alongside the existing workflow interruption and rate-limit cost. Claude Code users can report suspected mistakes with /feedback.

Fallbacks create a second billing question

Anthropic offers a server-side fallback that can retry a refused request on a recommended model. Setting fallbacks="default" with the server-side-fallback-2026-07-01 beta header returns one response identifying the model that ultimately handled the request.

An SDK middleware provides similar behavior across supported platforms. Applications that retry manually can redeem a fallback credit token to avoid paying the prompt-cache write cost twice.

The announcement leaves one invoice detail unresolved: how a newly billable refusal will appear when a fallback subsequently succeeds. Applications using fallbacks should record the original refusal, fallback attempt, serving model, token usage, and final outcome so those records can be reconciled with invoices.

Instrument refusals before invoices arrive

1. Inspect every successful response. Check stop_reason even when the HTTP status is 200.
2. Log the classifier category. Store stop_details.category, token usage, model, request identifier, and fallback outcome.
3. Separate refusal metrics. Track total refusals, billable-category refusals, fallback attempts, and fallback successes.
4. Cap retry fan-out. Set limits per request and agent turn, especially when sub-agents can generate several blocked calls.
5. Reconcile charges. Compare refusal logs with invoices once the policy takes effect, and report suspected false positives through Anthropic’s available support channels.

Workloads involving biological research, synthetic training data, model evaluation, or advanced LLM development have the greatest exposure. Until Anthropic publishes an effective date and clarifies fallback billing, response-level logging provides the most reliable basis for cost controls and disputes.