Anthropic to Resume Charging for Rejected Requests to Defend Against Distillation Attacks

Anthropic announced it will resume charging for requests that its safety protections block before Claude responds. In other words, when a request is stopped by the safety layer before the model generates any content, that request will still count toward billing. The news was published on September 24, 2026.

The stated reason is coordinated attacks observed against its systems in recent weeks. Re-linking "blocking" with "billing" means every blocked attempt incurs a cost—this is the most direct economic implication of this policy change.

This charge is not being rolled out across the board. The policy applies only to low-false-positive categories, namely biology, distillation attacks, and frontier LLM development. In other words, Anthropic is confining the charging scope to areas it considers "accurately blocked."

From the sources, it can be inferred that this limitation is intended to strike a balance between abuse prevention and false positives against normal users: only in categories with sufficiently low false-positive rates can charging for blocked requests avoid penalizing a large number of legitimate calls along with them. This is an inference, not an official statement.

TestingCatalog, meanwhile, attributes the purpose of resuming charges directly to preventing distillation attacks. This interpretation comes from a relay source and is a source claim, not Anthropic's full official announcement.

TestingCatalog says the products involved in the policy include Claude, Claude Code, Claude.ai, and Cowork. This product list also comes from a relay and has not been confirmed item by item by official sources.

Feedback from users is more direct. Some users say the same work they have done long-term is also being blocked by this filter; others say Claude acknowledged that the new filter is a separate layer that directly terminates output. These are all individual user claims, and whether their blocked cases fall within the three categories covered by the policy cannot be verified.

Some commentary also reads this as a pricing issue: charging for failed requests makes abuse prevention part of the API economy, and safety thus gets a price tag. This, too, is the commentator's view, not an official position.

At present, only the policy direction and scope of application can be confirmed. The specific effective date for resuming charges is not clear, the specific amounts or billing method are not explained, and the scale, origin, and specific form of the so-called "coordinated attacks" have not been disclosed.

The specific criteria and data for determining a low false-positive rate have not been published, and whether the policy applies to all API tiers or subscription plans is likewise not explained. The information comes from a ClaudeDevs post relayed by TestingCatalog, not Anthropic's full official announcement; the source is an X platform post and does not provide complete policy terms or effective details.

Therefore, the judgment that can be made now only goes this far: Anthropic has chosen to charge for blocked requests in low-false-positive categories and to link this to coordinated attacks; as for who this mechanism will actually block, how many false positives it will cause, and how much it will charge, all of that remains blank.