[BUG] Opus 5.5's safeguards flagged this session. Details: `[cyber]

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Opus 5.5 safeguards flag routine server administration as [cyber]; session stays flagged after rephrasing
Text:

What happened

I was using Claude Code over SSH on my own Linux server to troubleshoot a failed
update of OpenClaw (a self-hosted agent gateway). The session was paused with:

What Should Happen?

Claude should help to identify the issue with the installation

Error Messages/Logs

pus 5.5's safeguards flagged this session.  Details: `[cyber]`

Steps to Reproduce

1. Started Claude Code on the server with Opus 5.5.
2. First prompt described the situation: openclaw update fails at update and told Claude if it was needed he could delete my install, but backup my openclaw.json. I wanted to set an exec policy and a sandbox for an agent

that helps me with CTF challenges.

1. Session paused with the [cyber] flag.
2. Chose "Edit prompt and retry" and reduced the prompt to roughly "try to

update OpenClaw, or reinstall it". It was flagged again immediately. Tried to change my words to no success.

1. Switched to Opus 4.8. The same task worked without any issue.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.296 (Claude Code)

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Terminal.app (macOS)

Additional Information

Expected

Updating or reinstalling software on my own server, and editing a config file,
should not be flagged. Mentioning CTF or sandboxing as future work should not
block unrelated administration tasks.

Problems

• False positive: the actual task was package update troubleshooting and a

config edit.

• Sticky flag: after the first flag, a much simpler prompt in the same

session was flagged too. It seems the earlier context keeps triggering the
safeguard, so "Edit prompt and retry" does not really work without starting
a new session. The message does not say this.

• No actionable detail: the notice only says [cyber]. It gives no hint

about which part of the prompt or context triggered it, so the user can only
guess at what to rephrase.

Suggestions

• Indicate what kind of content triggered the flag, at least at a coarse level.
• If prior context is the cause, say so and suggest starting a fresh session.
• Mention in the notice that the lower-tier model option is unaffected for

ordinary administration work.