New Claude API accounts return a 400 when an agent edits anything before a thinking block
Anthropic's API returns a 400 on accounts created on or after August 31, 2026 when a request changes anything ahead of a returned thinking block. Agents that send thinking blocks back on those accounts have to treat history as append-only.
The Engineer · Build desk
Accounts from August 31, 2026 on get a 400 by default; older ones enforce the check only if a request sets the flag. Prompt rebuilds fail; appended messages and compaction pass. Resultsense says friction moves to paying customers. Anthropic calls its 90 to 99% result early evidence.
- constraint New accounts Created on or after August 31, 2026: the prefix check is on by default and a mismatch returns a 400, claim 7
- exposure Older accounts The check runs, but is enforced only if a request sets the flag; otherwise failing blocks reach the model, claim 8
- cost System prompt rebuilds Injecting today's date or reloading CLAUDE.md fails the check; append later versions mid-conversation, claim 11
- capability Appended messages, compaction Stay valid, as do changes to effort, max_tokens, tool_choice, metadata and cache_control, claim 10
- cost Paying customers Resultsense called the trade-off defensible and says it moves friction onto paying customers, claim 17
- exposure Anthropic Calls the 90 to 99% result early evidence and does not say how it was measured, claim 16
| Who | How | Kind | Claim |
|---|---|---|---|
| New accounts | Created on or after August 31, 2026: the prefix check is on by default and a mismatch returns a 400 | constraint | 7 |
| Older accounts | The check runs, but is enforced only if a request sets the flag; otherwise failing blocks reach the model | exposure | 8 |
| System prompt rebuilds | Injecting today's date or reloading CLAUDE.md fails the check; append later versions mid-conversation | cost | 11 |
| Appended messages, compaction | Stay valid, as do changes to effort, max_tokens, tool_choice, metadata and cache_control | capability | 10 |
| Paying customers | Resultsense called the trade-off defensible and says it moves friction onto paying customers | cost | 17 |
| Anthropic | Calls the 90 to 99% result early evidence and does not say how it was measured | exposure | 16 |
What happened
- Older accounts still run the check, but enforce it only when a request sets thinking.block_binding.prefix_mismatch_behavior; without that flag, blocks that fail still reach the model.
- According to the docs as dev.to relays them, "before" means the system prompt, the tools array and every earlier message, and a mismatch voids that thinking block and all later ones.
- The check still passes appended messages and server-side compaction, along with edits to effort, max_tokens, tool_choice, metadata or cache_control markers.
- The prefix check covers four models: Claude Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5.
Why it matters
- constraint A harness that rebuilds its system prompt or tools array on each turn cannot also return thinking blocks on an enforced account; the rebuild has to move to the end of the conversation.
- decision Test suites run on a pre-August 31 key will pass code that a newer key rejects, so teams must pick an enforced account or set the flag on test requests.
- cost Resultsense judged the trade-off defensible but said it puts the friction on paying customers, who rewrite integrations so Anthropic can limit distillation.
The error text gives the mechanism. As dev.to quotes the docs, the 400 reads "Invalid `signature` in `thinking` block. The block is bound to a different conversation." [4] A returned thinking block is checked against the context that produced it, and any difference voids the block [6]. For any account opened at or after 00:00 UTC on August 31, 2026, the check is on by default, and a failing block comes back as that error [7].
Anthropic's stated reason is distillation. Its October 12 post calls preserved thinking "a measure that prevents new API accounts (those created on or after August 31, 2026) from editing Claude's prior context." [1] It is one of three layers meant to stop other labs from training on Claude's reasoning [2]. Anthropic's summary of the three together: "Early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99%." [15] According to dev.to, the post does not say how that figure was measured [16]. It does say that "preserved thinking has required some developers to update their integrations." [3]
The check is narrower than a ban on edits. It runs on each `thinking` or `redacted_thinking` block an agent sends back. If the model cannot read the block, the API drops it without an error. Otherwise the docs require that "Nothing before the thinking block has changed." [5] By that rule, trimming the oldest turns to save context changes what precedes every remaining block, so each remaining thinking block fails [13].
The patterns the post lists first are re-rendering the system prompt and editing tools mid-session [11][12]. Stamping today's date into the system prompt is a small convenience, and on an enforced account it gets a 400. The documented fix for instruction files is to load `CLAUDE.md` or `AGENTS.md` once and append later versions as a mid-conversation system message, or in the next user turn if you don't trust the file's contents [11]. For tools, declare the full set up front, mark late ones with `defer_loading: true`, and offer or withdraw them with `tool_addition` and `tool_removal` blocks [12].
In our view, an agent on these accounts should keep its message list as a log that only grows and build each request from it. The docs, as dev.to reports them, count server-side compaction as valid because the check "compares what you sent, not the server's edited copy". [10]
What to watch
- Whether Anthropic makes the prefix check default on accounts created before August 31, 2026, which now enforce it only when a request sets the flag.
- Whether Anthropic publishes how it measured the 90 to 99% drop in harvested data.
- Whether agent frameworks that trim or re-render history by default change those defaults for enforced accounts.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+15
- Incentives40
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
In an October 12 research post on distillation defenses, Anthropic describes preserved thinking as "a measure that prevents new API accounts (those created on or after August 31, 2026) from editing Claude's prior context."
- [2]
Preserved thinking is one of three layers Anthropic built to stop other labs from training their models on Claude's reasoning.
- [3]
The same post concedes that "preserved thinking has required some developers to update their integrations."
- [4]
The 400 error begins with a path such as messages.1.content.0 and reads: Invalid `signature` in `thinking` block. The block is bound to a different conversation.
- [5]
For each thinking or redacted_thinking block sent back, the docs describe two checks: the model has to be able to read the block, or the API drops it without an error; and "Nothing before the thinking block has changed."
- [6]
"Before" means the top-level system prompt, the tools array and every message ahead of the block. If any of that differs from what produced the block, that block and every later thinking block are invalid.
- [7]
Accounts created on or after August 31, 2026, 00:00 UTC get the prefix check by default and receive the 400.
- [8]
On older accounts the check still runs, but it is enforced only on requests that set thinking.block_binding.prefix_mismatch_behavior; otherwise failing blocks go through to the model.
- [9]
The prefix check covers Claude Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5.
- [10]
Appending messages stays valid, as do changes to effort, max_tokens, tool_choice, metadata and cache_control markers, and server-side compaction, because the check "compares what you sent, not the server's edited copy."
- [11]
Re-rendering the system prompt fails the check, for example injecting today's date or reloading an updated CLAUDE.md or AGENTS.md into system. The documented fix is to load instruction files once and append later versions as a mid-conversation system message, or in the next user turn if you don't trust the file's contents.
- [12]
Editing tools mid-session fails the check. The documented fix is to declare the full set at the start, mark late tools with defer_loading: true, and offer or withdraw them with tool_addition and tool_removal blocks.
- [13]
Trimming the oldest turns from a history changes what precedes every remaining thinking block, so by the docs' rule every remaining thinking block is invalid.
- [14]
The same harness can pass on an account created before August 31, 2026 and fail on one created on or after that date, because default enforcement depends on account age.
- [15]
Anthropic reports: "Early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99%."
- [16]
Anthropic calls the 90 to 99% result early evidence and does not say how it was measured.
- [17]
The UK-focused outlet Resultsense called the trade-off defensible and pointed out that it moves friction onto paying customers.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toClaude's Anti-Distillation Rule Turns Your Agent's Message History Append-Only
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.