[BUG] False-positive AUP refusal during legitimate AI chatbot plugin development

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Multiple consecutive turns blocked with AUP refusals during legitimate AI chatbot plugin development work, with no indication of which content triggered the classifier.

The error message instructs to "try rephrasing the request" but the issue persisted across completely different requests, suggesting the trigger was accumulated context (likely from a running background agent) rather than the user prompt itself.

/clear did not resolve the issue while a background agent was still running. Only starting a fully new session AND switching from Opus 4.7 to Sonnet 4.5 resolved it.

<img width="1400" height="1171" alt="Image" src="https://github.com/user-attachments/assets/0d2dbb9a-775d-44b8-af49-4470f6ab0582" />

What Should Happen?

1. Legitimate development work on AI/chatbot codebases (which routinely contain system prompts, moderation logic, and prompt-handling code) should not trigger AUP classifiers.

1. If a refusal does occur, the error message should indicate which content category or context segment triggered it, so developers can address the actual cause instead of guessing.

1. /clear should fully reset classifier state, including context accumulated by background agents.

1. Background agent context should be isolated from the main conversation classifier rather than concatenated into one large input.

Error Messages/Logs

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Try rephrasing the request or attempting a different approach. If you are seeing this refusal repeatedly, try running /model claude-sonnet-4-20250514 to switch models.

Steps to Reproduce

1. Open a project containing a WordPress site that uses the AI Engine plugin (or any codebase containing AI chatbot logic, system prompts, and moderation code).

1. Use Opus 4.7 with 1M context and "Extra high" thinking.

1. Run several legitimate dev tasks in sequence:

• Verify SSH connection and check deployment status
• Deploy and test a Bots → Widget → Stream pipeline
• Run end-to-end test of the Bots API + embed
• Test full chat flow with Gemini streaming

1. Start a background agent for broad analysis (e.g., "Analyze codebase").

1. Let the background agent accumulate context (~80k+ tokens, 20+ tool uses) reading files that contain:

• System prompts as code constants
• Prompt injection defense logic
• Chat transcripts from test runs
• Streaming response handlers

1. Send the next user message → blocked with AUP refusal.

1. Try /clear and resend → still blocked.

1. Try rephrasing the request → still blocked.

1. Try "Try sending it again" button → still blocked.

Resolution that worked:

• Kill the running background agent
• Start a new session (not /clear)
• Switch to claude-sonnet-4-5
• Reduce thinking from Extra high to Normal
• Use narrow file-specific tasks

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

1.4758.0 (fb266c) 2026-04-24T20:22:30.000Z

Platform

Other

Operating System

Windows

Terminal/Shell

Other

Additional Information

Context

The project is a legitimate AI chatbot SaaS platform hosted on a Hetzner Cloud server stack. The work involved reviewing the integration between a WordPress site and the AI plugin, then testing a streaming chat pipeline using Google's Gemini API as a backend provider.

All files involved are standard development artifacts: PHP plugin code, JavaScript widget code, configuration files, and test outputs. None of the work involved generating harmful content, bypassing safety measures, or any policy-violating activity.

Why this matters

AI/chatbot development is a rapidly growing legitimate use case for Claude Code. Codebases in this domain routinely contain:

• System prompts stored as code constants or template files
• Prompt injection defense logic (which by definition contains examples of injection patterns)
• Moderation and content filtering code
• Test fixtures with edge-case or adversarial inputs (used to validate the chatbot's defenses)
• Raw streaming responses from model providers

If the AUP classifier flags this content as suspicious, Claude Code becomes effectively unusable for an entire segment of developers — exactly the developers building production AI applications who would benefit most from it.

Suggested fixes

1. Context isolation between background agents and main conversation — agent tool-use context should not be concatenated into the same classifier input as the user's direct prompts.

1. Surface the trigger in the refusal message — even a category hint ("flagged due to: prompt-like content in tool output") would let developers debug instead of guess.

1. Make /clear fully reset classifier state, including any active background agents.

1. Consider domain-aware classification for AI/ML codebases where prompt-like content is expected.

1. Add a /bug or in-app feedback command — currently /bug is not available in all environments, which is exactly when feedback is most valuable.

Workaround for other users hitting this

1. Kill any running background agents (× button on the task)
2. Start a brand new session — /clear alone is insufficient
3. Switch to Sonnet 4.5 (/model claude-sonnet-4-5)
4. Reduce thinking from Extra high to Normal
5. Use narrow, file-specific prompts instead of broad codebase analysis