Epic: Anthropic distillation protection (preserved thinking and reasoning_extraction refusals) #5160

Summary

Newer Claude models bind each thinking block to the conversation that produced it (preserved thinking, Bedrock docs). If the system prompt, tools, or any earlier message changes, replaying the block fails with a 400. This affects Fable 5.1, Opus 5.5, and Haiku 5.5. A new reasoning_extraction refusal also blocks prompts that ask the model to write out its reasoning.

The check is on by default only for accounts created on or after 2026-08-31, so older test accounts won't reproduce it. To force it on, send the thinking-binding-controls-2026-08-01 beta with thinking.block_binding.prefix_mismatch_behavior: "error".

Invalid `signature` in `thinking` block. The block is bound to a different conversation.

Refusals return HTTP 200 with stop_reason: "refusal" and a stop_details.category.

See https://support.claude.com/en/articles/16761192-preserved-thinking-changing-how-the-messages-api-handles-thinking-blocks-to-protect-against-distillation for more information.

Areas to test

• Documentation
• Bedrock model provider
• Anthropic model provider
• Vercel model provider
• LiteLLM model provider
• Both Python and TS Strands packages
• Context manager strategies that rewrite history ([FEATURE] Context Manager Opus 5.5 Distillation-protection support #4933)
• Plugins and hooks that inject per-turn context (strands-agents/stan#79, [BUG] harness-py: per-call ContextInjector reminders defeat implicit prompt caching (GPT-6 Luna on Bedrock) #4879)
• Changing the system prompt or tools mid-session
• Structured output ([BUG] Structured output fails with a 400 on Claude Opus 5.5 / Sonnet 5.5 / Fable 5.1 because the forced tool_choice fallback is rejected #5156)
• Session save and restore of thinking blocks ([BUG] strands-ts AnthropicModel redacted_thinking: Message.clone()/session save+restore corrupts the base64 data into an indexed object sent to the API #4587)
• Model or account switch mid-session ([BUG] BedrockModel replays another provider's reasoning blocks after a model switch, Claude ⇄ GPT fails both ways #4769)
• Multi-agent reasoning forwarding (Graph forwards reasoning blocks into downstream node input #2882)
• Refusal surfacing in AnthropicModel and BedrockModel ([BUG] LLM refusal error is not returned in the output #4539)
• Shipped prompts that ask for a reasoning field (evals judges, tools, skills)
• Automated tests that catch all of the issues
• Automated discovery (agentic?) of these issues on model release days