[Bug] Anthropic API Usage Policy classifier false positive on security terminology
Bug Description
That's an Anthropic Usage Policy classifier firing — and it's a false positive. The
content I was generating (AER tier table with source examples like "WSJ", "Krebs", "Black
Hat briefings") doesn't violate any policy. Here's what likely tripped it:
Why this happens
Anthropic runs a content classifier on Claude's outputs. In long sessions packed with
security/cyber vocabulary — PSIRT, vulnerability frameworks, threat modeling, "audit",
"Black Hat", "DEF CON", "exploit", etc. — the classifier sometimes over-fits and flags
benign content. Umbra is literally a cybersecurity intelligence product, so we're awash
in that vocabulary by necessity.
The error message you saw (Claude Code is unable to respond...violates Usage Policy) is
the safety net catching something. In this case it caught nothing real.
What to do when it happens
┌───────────────────┬────────────────────────────────────────────────────────────────┐
│ Option │ Notes │
├───────────────────┼────────────────────────────────────────────────────────────────┤
│ Retry (just │ Often works — classifier is non-deterministic. My second │
├───────────────────┼────────────────────────────────────────────────────────────────┤
│ Press ESC twice + │ Lets you tweak the prompt slightly before retry — sometimes a │
│ edit │ small rewording avoids the trigger │
├───────────────────┼────────────────────────────────────────────────────────────────┤
│ Switch models │ /model claude-sonnet-4-20250514 (the error its…
Note: Content was truncated.
Showing cached comments. Read the full discussion on GitHub ↗
5 Comments
Found 3 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
+1. Same root cause across homelab infrastructure work and a self-hosted XMPP chat server fork. Loki/Prometheus rule names, IP blocklist configs, VPN files, and XMPP server code all contain vocabulary that trips the classifier regardless of context or intent.
The classifier has no concept of "this is the operator's own infrastructure" or "this is a legitimate open source project" — it pattern-matches on terms in tool results and fires. One triggering tool result then poisons the rest of the session until a model switch or new session clears the context.
This matches the failure mode I am seeing on Claude Code 2.1.156: a long-running local development session accumulates security-adjacent vocabulary from logs, hooks, MCP/browser automation, and recovery work, then ordinary follow-up prompts get classified as Usage Policy / cyber-safeguard violations.
The most damaging part is that one false positive can poison the rest of the session, while the product does not expose a first-class private "report this request ID as a false positive" path from inside Claude Code.
I opened a sanitized reporting-path issue here: https://github.com/anthropics/claude-code/issues/64287
Private request IDs/log excerpts are staying in the support thread, but this issue is another strong example of why Claude Code needs context-aware classifier review and a private recovery/report route.
This is the crux of the whole thing: the classifier triggers on security terminology regardless of whether there's any actual misuse, target, or victim. "eFuse", "read-protect", "flash encryption" are just Espressif's documented feature names — naming them while provisioning my own board is enough to get blocked. Request IDs and the embedded report at #64405; canon #63751.
Another false-positive data point, from a domain with no security terminology at all.
Request ID:
req_011CceHXayCyfDVE8ir7cXbm(2026-07-02/03 JST)What the user asked for: writing text into a Microsoft Word document (a Japanese business document for a government subsidy application). Plain document-drafting instruction — no security, no code, no dual-use content.
Error returned:
Possibly related: the same environment is experiencing frequent Fable 5 safeguard flags with
apiRefusalCategory: reasoning_extraction(detailed telemetry posted in #67246 — 10 forced Fable→Opus switches in 77 minutes on the same legitimate subsidy-drafting workload). The hard AUP block above may be the same classifier family escalating from "switch model" to "refuse outright". Whatever it keys on, it is not the visible content of the user's request.Happy to provide more request IDs if useful — this workload reproduces the flags reliably.