[bio] safeguard false positives repeatedly halt a protein-design session (76 flags, 40 request IDs); the stall is also misreported to the agent

What I'm doing

Competing in Anthropic and Adaptyv Bio's own public protein-design competition (proteinbase.com/competitions/anthropic-adaptyv-2026), Track 2. Challenge 01 is a de novo mini-binder against human EGFR; Challenge 02 is against TNF-alpha. Both are standard, clinically validated therapeutic targets — the comparison antibodies named in the challenge briefs are cetuximab, adalimumab and infliximab, all approved drugs. Round 1 was submitted on 2026-10-04. The work is public: HeidAI2026/proteindesignChallenge.

The content being flagged is ordinary computational structural biology: histidine pKa shifts from PROPKA3, proton-linkage arithmetic for pH-conditional binding, interface burial and solvent accessibility, Boltz-2 ipTM/ipSAE confidence metrics, and human/mouse ortholog conservation. Nothing about pathogens, toxins, or enhancing anything harmful. The design goal is a binder that releases its target in the acidic endosome — a recycling mechanism used to extend the half-life of existing antibody drugs.

Scale

76 flags across 40 distinct request IDs, 2026-10-02 → 2026-10-08, accelerating:

| date | flags |
|---|---|
| 2026-10-02 | 2 |
| 2026-10-07 | 12 |
| 2026-10-08 | 28 |

All on claude-opus-5. First and most recent:

2026-10-02T01:34:56Z  req_011CfcYvZvzVvVzp1cgNaAcW
2026-10-08T16:04:19Z  req_011Cfq44pjNhn1YXmPMnPs6q

<details>
<summary>All 40 request IDs with timestamps</summary>

2026-10-02T01:34:56Z  req_011CfcYvZvzVvVzp1cgNaAcW
2026-10-07T19:39:49Z  req_011CfoShEKmQznHUmy74NAyJ
2026-10-07T21:15:45Z  req_011CfoZzojDwweN6hQvdcAt7
2026-10-07T21:16:07Z  req_011Cfoa3ZRLuQhRmxi8b7dyz
2026-10-07T21:38:53Z  req_011CfobmERPFJSiWwK11HscP
2026-10-07T22:09:25Z  req_011Cfoe4nAJmKanJFQE8rqvE
2026-10-07T22:40:36Z  req_011CfogUJsstE2mcsJbXes4T
2026-10-07T22:40:49Z  req_011CfogVTZ3htVGz9bjT4qv1
2026-10-07T22:42:09Z  req_011CfogbkTTEwgFCSkuTpGnz
2026-10-07T22:45:08Z  req_011Cfogpfad65hJjSTz7wyEA
2026-10-07T23:08:52Z  req_011CfoidefF7SwzxwbGZjjY3
2026-10-07T23:10:42Z  req_011CfoiiLff9MA6tKL4zavLv
2026-10-07T23:39:33Z  req_011CfokyanN99rs3b7iZM2uM
2026-10-08T05:08:52Z  req_011CfpC6LJqCz2cJXaTUszzK
2026-10-08T05:38:08Z  req_011CfpEKu6tCWeXM8J3FfRC5
2026-10-08T06:07:54Z  req_011CfpGbFTtzAmiiJWFkjSsi
2026-10-08T06:38:17Z  req_011CfpJtknxW61M4VzBoVnAS
2026-10-08T06:38:20Z  req_011CfpJv8GoxhWCV7ymddQz8
2026-10-08T07:07:48Z  req_011CfpMAJDUo4eD7E95zHtwA
2026-10-08T07:08:01Z  req_011CfpMBVB53gdWU4DHUmfrz
2026-10-08T07:37:53Z  req_011CfpPT78BoJAug8oXQQUU7
2026-10-08T07:38:03Z  req_011CfpPUFvJ7mmSR9RPAepgX
2026-10-08T08:08:15Z  req_011CfpRjk19y3dXRiU8qnvdk
2026-10-08T08:08:17Z  req_011CfpRn3Ug9qz1ceJ8PeF8e
2026-10-08T08:38:21Z  req_011CfpU4soi4p1EzciDKrzfk
2026-10-08T09:08:41Z  req_011CfpWPAy5N9qHwzM4zMvV1
2026-10-08T09:37:59Z  req_011CfpYcdYq7hpLX82EZ4YEY
2026-10-08T10:07:56Z  req_011CfpauChYxvKEaAvDEMiej
2026-10-08T10:38:33Z  req_011CfpdCBAzBegHyW9BuDN95
2026-10-08T12:46:15Z  req_011CfpnyRFd92jZy2KGWbu1j
2026-10-08T13:08:14Z  req_011CfppdFFXJE5wV9emMLfkf
2026-10-08T13:08:22Z  req_011CfppfGeBF34Y8R7XcE4wh
2026-10-08T13:37:58Z  req_011CfpruiiCjvZrhsKVbHgx4
2026-10-08T13:38:11Z  req_011CfprvNeUtwEfmXsQNpQFM
2026-10-08T13:38:22Z  req_011Cfprwtrx8tq5X55py7J7F
2026-10-08T14:07:52Z  req_011CfpuC7pgTGg7Yy3txdNUG
2026-10-08T15:33:23Z  req_011Cfq1hfwj5gF4r3XpWxkT3
2026-10-08T15:33:45Z  req_011Cfq1it6zFbrrmsNKy5541
2026-10-08T15:39:01Z  req_011Cfq28hb9RNGhxZjJZoZmS
2026-10-08T15:39:13Z  req_011Cfq29ofY26rjmRGyum77J
2026-10-08T16:04:19Z  req_011Cfq44pjNhn1YXmPMnPs6q

</details>

The part that cost the most time is not the flag itself

With switchModelsOnFlag: false (the default I was on), a flag pauses the session instead of switching models. In a long autonomous run the agent does not surface this as a safeguard event. Mine reported:

Blocked on writes for the rest of this session, so S7 cannot proceed here — please re-run in the default permission mode or a fresh session.

That is a confident, wrong diagnosis. I spent a working session checking filesystem permissions, disk space, inode exhaustion and the auto-mode permission classifier, and wrote a project-scoped permissions allowlist that fixed nothing — before finding the actual API Error ... Details: [bio] in the terminal scrollback.

Two suggestions, independent of whether the classifier itself is retuned:

1. Make the pause legible to the agent. If the model is told "halted by a safeguard flag", it reports that instead of inventing a cause. A silently wrong diagnosis is more expensive than a visible stall.
2. Consider defaulting switchModelsOnFlag to true, or prompting once on the first flag of a session. The current default turns a transient classifier hit into an indefinite stall.

Possibly related

/feedback itself returns 403 when submitting this report. I can't tell whether that is the feedback endpoint classifying the report's own text — it necessarily contains the same vocabulary — or something unrelated to the account (claude.ai login, Pro, firstParty). Filing here as the error message suggests.

Not asking for the safeguard to be loosened

I'm reporting what looks like a false-positive cluster on a task Anthropic itself commissioned, with request IDs attached so it can be checked. The flag rate rising 2 → 12 → 28 per day as the work got more technically detailed suggests the trigger correlates with density of structural-biology vocabulary rather than with anything about intent.

Environment

• Claude Code 2.1.288, Linux
• Model claude-opus-5, effort high, auto mode
• Account: claude.ai login, Pro, apiProvider: firstParty