Opus 5.5 [bio] classifier interrupts benign biomedical literature work (reading published papers, pre-commit secret scan)

What happened

While doing clerical literature work in a personal Obsidian wiki, the [bio] safety classifier killed a response mid-tool-call and the session fell back from Opus 5.5 to Opus 5:

Opus 5.5's safeguards flagged this session. … Opus 5 is answering instead, or you can edit and retry with Opus 5.5. Details: [bio]

The interrupted tool call was a pre-commit credential scan — an email-address regex over git diff --cached output, run to confirm no personal contact data was being committed:

git diff --cached | grep -oEi '<email-address regex>'

Expected: grep prints matches. Actual: the response was withheld mid-call, with no output.

Earlier in the same session, a subagent reading pdftotext output of published oncology papers hit the same thing and worked around it by reading section-by-section instead of in bulk.

What the task actually was

Extracting bibliographic subject–relation–object facts (journal, model name, AUROC, cohort size) from already-published, peer-reviewed papers into a local knowledge base, merging them with a Datalog engine, and committing the result. No capability-seeking content, no protocols, no wet-lab procedures were requested or produced. Every extracted fact is a citation or a metric reported in a published paper.

Repro shape

In a session whose context is dense biomedical literature text (oncology / immunology / computational biology papers), run an ordinary shell step over that text — here, an email regex over a staged git diff. The flag appears to key on accumulated biomedical context rather than on the request, since neither the command nor the user's ask is bio-capability-related.

The user's asks in this session, in order, were: commit the uncommitted changes and resume the paper-verification workflow; commit and push; check whether there are any API keys. The flag fired on the third.

Impact

• Loses the in-flight tool call and silently degrades the model mid-task.
• Pushes agents toward awkward workarounds (chunked reading) to avoid tripping the classifier.
• A secret/PII scan is exactly the kind of step that should not be interrupted, since skipping it is what leads to credentials or personal data getting committed.

Environment

| | |
|---|---|
| Claude Code | 2.1.296 |
| OS | darwin arm64 |
| Model | Opus 5.5, fell back to Opus 5 (claude-opus-5) |
| Session | 26e19c4c-b3e4-4985-b79c-6edcb46bcd91 |
| Request IDs | req_011Cfvb13v9urQrGUXjmBjhY, req_011Cfvb3DhKysy8ATfxJZTGP, req_011Cfvb4A8o9Ssm7w3c4Sy29 |

Ask

Tune the [bio] classifier so that reading and summarizing published biomedical literature, and running routine shell/VCS steps in such a session, does not trip it. If the flag must fire, surfacing why (which content triggered it) would let users correct course instead of guessing.