[Bug] False positive [cyber] block on legitimate fleet update request (Opus 5.5)
Bug Description
False positive [cyber] on legitimate fleet administration (Opus 5.5)
Context: I'm a developer at Automaserv, a Brazilian software company. AutomaDesk is our own
private fork of RustDesk, which our support team uses to assist our customers. It is
installed on their machines with their consent. The session was working in our own
AutomaDesk repository and admin database.
What happened:
- Step 1 (allowed): "how is the fleet?" Claude queried our own AutomaDesk server database
and reported how many machines run each client version.
- Step 2 (blocked): "force the update on these two machines that are on 1.4.20–1.4.27."
This is AutomaDesk's built-in auto-update, delivering our own signed release to our own
installs. The session was flagged [cyber], and my clarification ("the update is
AutomaDesk's own feature") was blocked too.
- The same request worked after I switched to Opus 4.8.
Request IDs: req_011CfpfkrBPBm82sTYq6Lcvi, req_011Cfpfou3N1YWoky7LQZNan
Message IDs: msg_011CfpfkrhdPxTEGFwi6pAXK, msg_011CfpfoueKa2MSHUv3JYPsa
Our global CLAUDE.md already explains this context: own product, customer consent,
own infrastructure. Routine release management of our own remote-support product
should not be classified as malicious. I'd also like to know whether there is a
verification or allowlist process for companies whose normal work (remote support,
fleet updates) overlaps with these filters.
Environment Info
- Platform: win32
- Terminal: windows-terminal
- Version: 2.1.294
- Feedback ID: abc18f8b-f585-461a-bb7c-c1d8f56a4948