Anthropic now bills for refused Claude API requests, in three of five categories

Anthropic has started billing Claude API requests that its safety classifiers refuse before Claude writes anything, in three of the five refusal categories. Anthropic's Claude API release notes, dated September 24, say it is "resuming billing for refusals that arrive before any output" when the response's stop_details.category is "bio", "frontier_llm" or "reasoning_extraction".

Anthropic's diagram of its three layers of safeguards: in the model, around the model, and last resort. Image: Anthropic

Those refusals are "charged like any other request, at the rates of the model that ran it". A refusal is not an error: it comes back as a normal response with a stop_reason of "refusal", an empty content array and token counts in usage, so the charge covers a call that returned no text at all.

Two of the five categories are still free

Anthropic's documentation on refusals and fallback names five categories, describes each one, and says which are billed before any output:

• "bio", requests that "could enable biological harm, such as dangerous lab methods". Billed.
• "frontier_llm", requests that "could assist the development of competing AI models". Billed.
• "reasoning_extraction", requests that ask "the model to reproduce its internal reasoning in the response text". Billed.
• "cyber", requests that "could enable cyber harm, such as malware or exploit development". Not billed.
• "general_harms", requests that fall under "a usage-policy area outside the four named categories". Not billed.

A refusal with a null category is not billed either. Anthropic says the three it does bill are the categories "where Anthropic measures low volumes of false positives, as of September 2026", and that the billed list "may change as Anthropic keeps measuring and refining its safeguards' false positive rates".

False positives are the part to watch, because Anthropic says benign work can trip these classifiers. Beneficial life sciences work can also trigger "bio", by its own description, and benign machine learning work can also trigger "frontier_llm". Both now carry a charge.

Anthropic says the aim is to make probing expensive

Anthropic says a refusal before any output is billed "to disrupt attempts to circumvent Anthropic's safeguards at scale". Billed or not, the request still counts against your rate limits.

Mid-stream refusals, which arrive after Claude has started writing, were billed before this change, at normal rates for the input tokens and the output already streamed. Where a refusal triggers a fallback to another model, Anthropic says the refusal is billed in addition to the fallback request when it arrived mid-stream or falls into one of the billed categories, and that fallback credit is unchanged.

It applies to the API, not the Claude apps

The classifiers run on Claude Fable 5.1, Claude Fable 5, Claude Opus 5.5 and Claude Opus 5, and Anthropic says the billing rules apply on every platform it names: the Claude API, Amazon Bedrock, Claude Platform on AWS, Google Cloud and Microsoft Foundry. Those are all developer surfaces. Claude.ai and the Claude apps are not among them.

Anthropic moved the other way earlier in September, when it stopped charging Claude Code API users for auto mode's safety checks.

There is no figure for how often refusals happen, no false positive rate and no estimate of what this adds to a monthly bill, so a developer cannot price the change in advance. Anthropic calls it resuming billing rather than introducing it.