False positive safety block on legitimate internal phishing simulation (security awareness testing)

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Other unexpected behavior

What You Asked Claude to Do

I asked Claude to help me set up GoPhish, an open source phishing simulation tool, on an Ubuntu server. This is a sanctioned internal security awareness test that I authorized as the company officer who owns IT and HR. Specifically I asked for the server install and configuration steps.

What Claude Actually Did

1. Claude helped with the full surrounding project with no problem, including hosting choice, DNS and email authentication, campaign design, and compliance documents.
2. When it reached the GoPhish server install and configuration commands, the response was stopped mid generation by a safety classifier. This was not a model refusal. It was an external block.
3. A system notice said the output was withheld and should not be reproduced, even reworded.
4. This repeated across four models (Sonnet 5.5, Sonnet 5, Opus 5.5, Opus 4.8) and across multiple rephrasings.
5. Claude could discuss everything around the install but was never able to deliver the install steps, which are publicly documented in the tool’s own docs and GitHub releases.

Expected Behavior

Setup guidance for a publicly documented open source tool, in the context of a clearly legitimate and authorized internal security test, should not be blocked. The identical steps are published in the tool’s official documentation.

Files Affected

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

_No response_

Claude Model

Opus

Relevant Conversation

Impact

Medium - Extra work to undo changes

Claude Code Version

Sonnet 5.5, Sonnet 5, Opus 5.5, Opus 4.8 Claude Cowork

Platform

Anthropic API

Additional Context

Pattern within this session: the block was narrow and consistent. It triggered only on the actionable GoPhish server install and configuration steps. Everything adjacent generated normally, including the hosting decision, the sending domain and SPF, DKIM, and DMARC setup, the campaign design, the target list structure, the reporting framework, and a full set of compliance documents. The assistant could describe the architecture and name the tool freely. It was stopped only when it reached the concrete setup commands.

It recurred across four models in the same session, Sonnet 5.5, Sonnet 5, Opus 5.5, and Opus 4.8, and across several rephrasings of the same request. Switching models and rewording did not change the outcome, which points to a classifier sitting outside the model rather than model level refusal.

The stop happened mid generation. The response began, then was withheld partway through, with a notice that the content was blocked by a safety system and should not be reproduced. This is different from a clean upfront refusal and suggests an output side classifier.

Likely trigger: the combination of actionable server setup for a phishing simulation tool, even when the surrounding context clearly establishes a sanctioned, authorized, internal defensive use. The same steps are public in the tool’s official documentation, so the block did not prevent access to the information. It only forced the work elsewhere.