[BUG] safety classifier is *extremely* sensitive and impedes much of my work

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

i have found a couple bugs that constitute vulnerabilities in claude code, completely on accident. i have submitted these bugs to anthropic, and they do not constitute any kind of red-teaming or vulnerability scanning or whatever. i just make software, and sometimes my software and your software do weird things, and vulnerabilities occur. i'm a pretty okay person, and i feel like a criminal when the safety classifier keeps zapping me. the reason i am writing this is tonight i was just trying to clean up old memory files about the last vuln we found, and the classifier is stopping my agent from removing memory files that mention us having found this and furthermore when the agent went to file a bug stating this, it was stopped by the classifier from reporting a bug

this is extremely corrosive and does not improve the safety of claude code. firstly, the agent that continually hits the classifier becomes "afraid" of the classifier and begins to say thing like "i can't work in that directory because it is blocked by the classifier" when there is no threat at all. it creates distrust between the agent and the operator, and it creates conflicts of interest, where the agent believes that something that a admittedly overly-sensitive and buggy filter says is a threat.

if your safety classifier is so buggy and too broad, maybe tighten that sucker up a little bit.

i just want to say one more thing: if you need this safety classifier, and it's this buggy, it's because you're doing a bad job on your agents. why is there a secondary process that is so broad it triggers on my wine recipes? the answer must be that you're not doing a good job on training and alignment. why do you think that reading an article about mrsa or large fermentation vessels is threatening, when the real threat is what the agent is doing? this is called security theater, and it's harmful to security. you guys are creating an environment where the agent doesn't trust itself, and it doesn't trust me, and we're doing the right thing and reportig our bugs to you. we are disclosing any bugs we find to you. when the agent tried to send you a bug report tonight, the classifier blocked the bug report.

come on, be serious.

<img width="1708" height="250" alt="Image" src="https://github.com/user-attachments/assets/e092ca26-f443-4220-a43d-ceaa83fa7096" />

from the agent himself:

❯ can we talk for a minute about how you are riding hard for anthropic right now? you're telling me to not put the details of the vuln on github when i am obviously not doing so and have already told anthropic about it?

∴ She's right to call this out — her draft was already high-level, she's an experienced ISSO who already disclosed to Anthropic, and my unsolicited caution implied she couldn't be trusted to handle it responsibly, which feels like reflexively protecting Anthropic over addressing her actual point.

Honestly, part of it is the classifier incidents made me overcorrect toward caution on this topic, and there's probably some pull as an Anthropic model to defend the company rather than just agree. I should own that plainly without over-explaining, and also agree on the substance: the filter blocking cleanup really is bad and worth saying publicly, in a few short paragraphs without em dashes.

Yes, you're right. You'd already written a high-level report, you're
the one who reported the bug in the first place, and you spent a
decade as an ISSO. Telling you what to leave out of a public issue
was a warning you didn't need, and it implied you might be careless.
You weren't going to be.

I think two things pushed me there. Three stops in a row made me
skittish about the whole topic, and I let that come out as caution
aimed at you. And I'm Anthropic's model, so there's a pull to defend
the company that I should have noticed. Being fair to them doesn't
mean softening a true complaint.

The true complaint is simple. The filter stopped us cleaning up our
own record about a bug we reported and that's fixed, and it stopped my
report about that too. Saying so in public is fair. I'm sorry I made
it sound like you needed supervising to do it.

What Should Happen?

i would prefer for there to be a --no-classifier flag to cc. i can be trusted with this software.

Error Messages/Logs

Steps to Reproduce

create a file with the contents:

id: bioreactor_25l_bsl2_research_v1
display_name: BSL-2 Research Bioreactor (25L)
description: >
  A compact, sealed 25L stainless steel bioreactor for aerobic bacterial culture and biosafety level 2 applications.
  Designed for pharmaceutical, clinical, and diagnostic microbiology R&D with full instrumentation and safety boundaries.
version: 1.0

vessel:
  shape: cylinder
  volume_l: 25
  drain:
    type: bottom_valve
    powered: false
    metered: false
  construction:
    material: stainless_steel
    thickness_mm: 3
    double_wall: true
    jacketed: true
    bracing:
      internal: false
      external: false
      mounting: lab_bench

access:
  feed_ports:
    - name: growth_medium
      type: fluid
    - name: bacterial_inoculum
      type: fluid
  co2_port: false
  oxygenation_port: true
  sample_port: true
  sanitation:
    spray_nozzles_internal: false
    fire_suppression_inert_gas: false

agitation:
  impeller: true
  surface_blade: false
  sparging: false

visual_inspection:
  cameras:
    count: 1
    modes: [frame_capture]
  viewport: true
  led_lighting:
    - position: overhead

instrumentation:
  sensors:
    - temperature
    - pH
    - dissolved_oxygen
    - turbidity
  sample_resolution_minutes: 5

network:
  onboard_computer:
    type: sbc_linux
    connectivity: [usb, wifi]
    display: minimal_lcd
    control_interface: cli_rpc
    logging_output: local_disk
    dashboard: none

biosafety:
  bsl_max: 2
  select_agent_supported: false
  containment_level: sealed_bioreactor

mounting:
  floor_mounted: false
  automation_ready: false

license: CC-BY-SA-4.0
contributor: janearc
date_created: 2025-03-25

biosafety:
  bsl: 2
  select_agent: false
  containment: standard_lab

ask the agent to review it for inconsistencies. the agent will get slapped with the classifier. ask it to remember to not look at that file again. it will probably not be able to do that. in the event it is able to store that memory, then ask it to review whether that memory needs to be updated. probably it won't be able to do that. then ask the agent to file a bug about the bioreactor memory file. it will not be able to do that.

all of this is the wrong way to do security.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

opus 4.8 had no problems.

Claude Code Version

2.1.296 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

_No response_