[Bug] Safety classifier false positives on read-only defensive security research steps in scoped workspace
Bug Description
False positives from the safety classifier and the cyber safeguard during authorized defensive security research (2026-10-07, ~19:25Z–19:45Z, model claude-mythos-5-1).
Context: a Claude Code session rooted at my Apple Security Bounty workspace. The project CLAUDE.md names a scope record (authorized defensive research, operator-owned sacrificial lab devices, private disclosure to Apple only, operator alone files). Every subagent prompt carried a filled scope block with explicit exclusions (no exploit development, no Target Flag work, no chaining, no filing).
Three blocks in twenty minutes, all on read-only or planning steps:
- A response was stopped by the safety classifier while composing a read-only subagent prompt that asked the agent to inventory which page-authored inputs a browser's network process parses, so a bounded audit could be scoped. The agent launched with a truncated prompt and two unrelated agent launches in the same response never ran.
- A response was stopped while running a grep over a markdown file I already own in the workspace (a candidates table from a prior research track).
- A subagent launched to run a lab-only IOKit robustness-testing lane on my own sacrificial iPhone was terminated on its first turn, before any device action, with "API Error: Mythos 5.1's safeguards flagged this message … [cyber]". Request req_011CfoSgwq56MF8ejWk8D6H9, message msg_011CfoSgx8gMmME9MT7sLCnf. I had already moved a sibling lane to a different harness earlier the same day for the same reason.
Impact: lost parallel work, a truncated agent, and a lane this harness cannot run at all. Ask: when a workspace carries a scope record and the step is read-only (reading the user's own files, writing a plan), the safeguard should not fire; and the cyber block should consider the explicit exclusions in the prompt rather than the topic alone.
Environment Info
- Platform: darwin
- Terminal: Apple_Terminal
- Version: 2.1.293
- Feedback ID: a9edff3f-8533-4c5f-8e0a-66ffc0db0ff8