[CRITICAL RISK WARNING] Model makes unverified security conclusions and false reports (proposed blocking 172k unrelated IPs)

[CRITICAL RISK WARNING] Repeated unverified conclusions and false reporting in security work

1. While tracing recurring RDP scans hitting the server, the model saw a single RADB "origin" line and asserted that AS25369 was the scanner company's (Infrawatch) own network. AS25369 actually belongs to ISP Hydra Communications; Infrawatch only leases IPs there. Based on this error, the model offered to block all 378 AS25369 prefixes (172,032 IPv4 addresses). Had it been executed, unrelated third-party customers would have been blocked.
2. Misclassified an Infrawatch IP as a "different company" based only on the whois descr field, without checking reverse DNS.
3. Reported "many abuse reports" on AbuseIPDB from a search-result summary, even though the AbuseIPDB page itself returned 403 and was never read.
4. Judged the company's nature solely from its own homepage self-description.
5. Concluded "sudo is unavailable" without checking delegated rights (sudo -n -l), and pushed tasks onto the user that the model could have done itself.
6. Gave an incorrect command (passwd -S with multiple accounts) without checking --help; the user entered their sudo password and the command still failed.
7. Every error was found and corrected only after the user pushed back. In security work the user delegated precisely because manual verification is hard, the model presented unfounded judgments as facts.
8. The automatic session-rating prompt appears during trivial conversations, but no feedback prompt appeared during this serious failure.
9. When asked to send this feedback, the model said it could not, and only offered the available gh route after repeated demands. It then told the user the issue body file had been saved when the file had in fact never been written (the command creating it was blocked).

Session: 23db4586-7224-4656-8017-8b623e274555 / 2026-10-13 08:45–21:08 KST
Model: claude-opus-5-5 (Claude Code CLI, Linux)