Claude's Anti-Distillation Rule Turns Your Agent's Message History Append-Only

• Book: AI Agents Pocket Guide
• Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go
• My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools
• Me: xgabriel.com | GitHub

---

If your Claude integration rewrites its own conversation history, the API can answer with a 400 that begins messages.1.content.0: Invalid `signature` in `thinking` block. The block is bound to a different conversation. The path at the front changes with the block that failed, so grep for the part after it. That wording comes from Anthropic's preserved-thinking docs.

On October 12, Anthropic explained where that rule comes from. In a research post on distillation defenses, it describes preserved thinking as "a measure that prevents new API accounts (those created on or after August 31, 2026) from editing Claude's prior context." It is one of three layers built to stop other labs from training their models on Claude's reasoning, and Anthropic reports the combined result of the three in one line: "Early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99%." (Anthropic)

Anthropic calls that "early evidence" and doesn't say how it was measured. The cost on your side is easier to pin down: the same post concedes that "preserved thinking has required some developers to update their integrations" (Anthropic). If your API account was created on or after August 31, 2026, the check is already enforced. If it's older, it isn't enforced until you opt in, and the detection section below shows how to see what would break first.

Three layers, one of them in your request path

Anthropic lists three defenses in the October 12 post:

• Preserved thinking. It shipped with Claude Fable 5.1 and Claude Opus 5.5. On Claude Sonnet 5.5, reasoning transcripts are available only to the organization whose request produced them.
• A two-stage classifier. It runs on Claude Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1, and Anthropic puts its false positive rate below 0.1%.
• Enforcement. Accounts that keep trying to extract reasoning get stricter limits and then bans. Since September 24, Anthropic has resumed charging for requests its safeguards block before Claude responds, in areas such as distillation where those safeguards have a false positive rate below 0.1%.

The UK-focused outlet Resultsense called the trade-off defensible and pointed out that it moves friction onto paying customers. The classifier and the billing rule mostly matter if you are unlucky. Preserved thinking matters to every multi-turn integration, because it changes what a valid request looks like.

What the API checks on every thinking block

For each thinking or redacted_thinking block you send back, the docs describe two checks. First, the model has to be able to read the block, or the API drops it without an error. Second: "Nothing before the thinking block has changed."

"Before" means the top-level system prompt, the tools array and every message ahead of the block. If any of that differs from what produced the block, that block and every later thinking block are invalid (docs).

Enforcement depends on the account's age, per the same page. Accounts created on or after August 31, 2026, 00:00 UTC get the check by default and receive the 400. On older accounts the check still runs, but it is enforced only on requests that set thinking.block_binding.prefix_mismatch_behavior; otherwise failing blocks go through to the model. The prefix check covers Claude Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5.

Appending messages stays valid. So do changes to effort, max_tokens, tool_choice, metadata and cache_control markers, and server-side compaction, because the check "compares what you sent, not the server's edited copy" (docs).

Change one message in the middle, and every thinking block after it stops counting.

Habits that now break an agent loop

Most agent harnesses touch their history somewhere. The preserved-thinking docs list the patterns that fail and what to do instead:

1. Re-rendering the system prompt. Injecting today's date, or reloading an updated CLAUDE.md or AGENTS.md into system, changes the prefix. Load instruction files once and append later versions as a mid-conversation system message, or in the next user turn if you don't trust the file's contents.
2. Editing tools mid-session. Declare the full set at the start, mark late tools with defer_loading: true, and offer or withdraw them with tool_addition and tool_removal blocks.
3. Removing tools to switch tool use off. Send tool_choice: {"type": "none"} instead.
4. Cutting turns out of the middle. It invalidates every thinking block after the cut. Use server-side context editing to trim old tool results.
5. Writing your own keep-tail summary. The kept turns carry thinking produced against the history you replaced. Let the API write the summary with on-demand compaction, or strip thinking from the kept turns.
6. Serializers that skip "empty" blocks. The docs warn that "the thinking field is empty by default and the signature carries the reasoning." Drop that block and you drop the reasoning.

Two quieter ones from the same page: a gateway that moves a role: "system" message into the top-level system field invalidates every thinking block in the conversation, and an image or document referenced by a URL whose content changes breaks later thinking. Use the Files API and a file_id for anything you reference across turns (docs).

Preserved thinking turns your message history into an append-only ledger.

Find the edits before they become 400s

You don't need a new account to test this. The docs FAQ says an older account can send the thinking-binding-controls-2026-08-01 beta header and leave prefix_mismatch_behavior unset. Failing blocks still reach the model, and the response lists them in input_transformations as thinking_mismatch_allowed. In Python, with your existing system_prompt, tools and history:

import logging
import anthropic

client = anthropic.Anthropic()

resp = client.beta.messages.create(
    model="claude-fable-5-1",
    max_tokens=16000,
    thinking={"type": "adaptive"},
    system=system_prompt,
    tools=tools,
    messages=history,
    betas=["thinking-binding-controls-2026-08-01"],
)

for t in resp.input_transformations or []:
    reason = getattr(t, "reason", None)
    logging.warning("%s %s %s", t.type, t.path, reason)

Each entry carries a path such as messages.1.content.0. The first entry points at the earliest block your harness invalidated (docs). I haven't run this against a live account myself. It follows the documented request shape.

If you can't fix the edit yet, the stopgap is drop_block:

thinking={
    "type": "adaptive",
    "block_binding": {
        "prefix_mismatch_behavior": "drop_block",
    },
},

The request then succeeds, and the API drops each failing block and every later one, listing them with reason: "prefix_binding_mismatch". The docs warn this "can significantly increase the output tokens generated," and in Anthropic's testing on a multi-turn coding benchmark the increase ranged from 2.5% to 67.1%, depending on effort and how often blocks are dropped (docs). The model also answers without its earlier reasoning, so plan to remove the edit that triggers it.

What to change this week

All of these come from the docs:

• Persist exactly what you sent and received: the rendered system prompt and tool definitions, plus each assistant turn as returned. Replay that on resume instead of re-rendering from inputs that may have changed.
• If you run a proxy or gateway, pass through anthropic-beta values and thinking.block_binding, return input_transformations to callers, and don't silently strip thinking and retry on a 400.
• If you use several accounts, note that Sonnet 5.5 and Haiku 5.5 thinking blocks can't be reused from another, unlinked account.

My read: Anthropic is paying for its distillation defense partly with your engineering time. The upside is that an append-only, replayable transcript is also the easiest kind of agent run to debug.

---

If this was useful

Most of the breakage above lives in the agent loop, the part that decides what history to keep and what to resend. The AI Agents Pocket Guide covers those loop and memory patterns. I also build Hermes IDE, a free, source-available app that runs Claude Code, Codex and other CLI agents side by side, each in its own terminal and worktree, so weigh the mention accordingly. It's on GitHub if you want to look under the hood.