Claudes Anti-Distillation-Regel macht Nachrichtenverlauf von Agenten append-only

If your Claude integration rewrites its own conversation history, the API can answer with a 400 that begins messages.1.content.0: Invalid `signature` in `thinking` block. The block is bound to a different conversation. The path at the front changes with the block that failed, so grep for the part after it. That wording comes from Anthropic's preserved-thinking docs.

On October 12, Anthropic explained where that rule comes from. In a research post on distillation defenses, it describes preserved thinking as "a measure that prevents new API accounts (those created on or after August 31, 2026) from editing Claude's prior context." It is one of three layers built to stop other labs from training their models on Claude's reasoning, and Anthropic reports the combined result of the three in one line: "Early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99%." ( Anthropic )

Anthropic calls that "early evidence" and doesn't say how it was measured. The cost on your side is easier to pin down: the same post concedes that "preserved thinking has required some developers to update their integrations" ( Anthropic ). If your API account was created on or after August 31, 2026, the check is already enforced. If it's older, it isn't enforced until you opt in, and the detection section below shows how to see what would break first.

Anthropic lists three defenses in the October 12 post:

The UK-focused outlet Resultsense called the trade-off defensible and pointed out that it moves friction onto paying customers. The classifier and the billing rule mostly matter if you are unlucky. Preserved thinking matters to every multi-turn integration, because it changes what a valid request looks like.

For each thinking or redacted_thinking block you send back, the docs describe two checks. First, the model has to be able to read the block, or the API drops it without an error. Second: "Nothing before the thinking block has changed."

"Before" means the top-level system prompt, the tools array and every message ahead of the block. If any of that differs from what produced the block, that block and every later thinking block are invalid ( docs ).

Enforcement depends on the account's age, per the same page. Accounts created on or after August 31, 2026, 00:00 UTC get the check by default and receive the 400. On older accounts the check still runs, but it is enforced only on requests that set thinking.block_binding.prefix_mismatch_behavior; otherwise failing blocks go through to the model. The prefix check covers Claude Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5.

Appending messages stays valid. So do changes to effort, max_tokens, tool_choice, metadata and cache_control markers, and server-side compaction, because the check "compares what you sent, not the server's edited copy" ( docs ).

Change one message in the middle, and every thinking block after it stops counting.

Most agent harnesses touch their history somewhere. The preserved-thinking docs list the patterns that fail and what to do instead:

Two quieter ones from the same page: a gateway that moves a role: "system" message into the top-level system field invalidates every thinking block in the conversation, and an image or document referenced by a URL whose content changes breaks later thinking. Use the Files API and a file_id for anything you reference across turns ( docs ).

Preserved thinking turns your message history into an append-only ledger.

You don't need a new account to test this. The docs FAQ says an older account can send the thinking-binding-controls-2026-08-01 beta header and leave prefix_mismatch_behavior unset. Failing blocks still reach the model, and the response lists them in input_transformations as thinking_mismatch_allowed. In Python, with your existing system_prompt, tools and history:

import logging import anthropic client = anthropic. Anthropic () resp = client. beta. messages. create ( model = " claude-fable-5-1 ", max_tokens = 16000, thinking = { " type ": " adaptive " }, system = system_prompt, tools = tools, messages = history, betas = [ " thinking-binding-controls-2026-08-01 " ], ) for t in resp. input_transformations or []: reason = getattr ( t, " reason ", None ) logging. warning ( " %s %s %s ", t. type, t. path, reason ) Enter fullscreen mode Exit fullscreen mode Each entry carries a path such as messages.1.content.0. The first entry points at the earliest block your harness invalidated ( docs ). I haven't run this against a live account myself. It follows the documented request shape.

If you can't fix the edit yet, the stopgap is drop_block:

thinking = { " type ": " adaptive ", " block_binding ": { " prefix_mismatch_behavior ": " drop_block ", }, }, Enter fullscreen mode Exit fullscreen mode The request then succeeds, and the API drops each failing block and every later one, listing them with reason: "prefix_binding_mismatch". The docs warn this "can significantly increase the output tokens generated," and in Anthropic's testing on a multi-turn coding benchmark the increase ranged from 2.5% to 67.1%, depending on effort and how often blocks are dropped ( docs ). The model also answers without its earlier reasoning, so plan to remove the edit that triggers it.

My read: Anthropic is paying for its distillation defense partly with your engineering time. The upside is that an append-only, replayable transcript is also the easiest kind of agent run to debug.

Most of the breakage above lives in the agent loop, the part that decides what history to keep and what to resend. The AI Agents Pocket Guide covers those loop and memory patterns. I also build Hermes IDE, a free, source-available app that runs Claude Code, Codex and other CLI agents side by side, each in its own terminal and worktree, so weigh the mention accordingly. It's on GitHub if you want to look under the hood.