[BUG] AUP classifier false-positive (session poisoning) persists through 2.1.167 — benign git command blocked; all work impossible. Regression spans 2.1.165–2.1.167. Cluster: #65846 #61185

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Related cluster (distinct domain + precise regression window): #65846
(RMM/remote-desktop), #61185 (sysadmin/cyber audit), #63751, #64405, #65592,
#65699, #65750, #65779, #65835. Appears to be one broad AUP-classifier
regression hitting unrelated legitimate domains.

My case — pharmacology / pharmacokinetics. Building a PK-simulation SaaS
(pharmacometrics; Rust PK engine, Supabase, Next.js) with Claude Code.

Strongest evidence — the triggering request was completely benign. The block
below fired during routine git worktree housekeeping (worktree status,
commits ahead/behind, an orphan branch, tags). There was no pharmacology and
no security content in that turn. This points to session-state / accumulated-
context poisoning (same mechanism as #61185), NOT immediate-message content.
A git status-class command cannot violate the Usage Policy.

Regression — persists through versions. Started at 2.1.165, still present on
2.1.167 (whose changelog is only "Bug fixes and reliability improvements").

Session poisoning. Once it fires it returns systematically; new sessions and
context stripping on the Claude Code side do not recover it. The whole project
is poisoned.

Impact: COMPLETELY BLOCKING. No work is possible at all.

What Should Happen?

1. Benign engineering requests (e.g. git worktree housekeeping) must never be

classified as Usage Policy violations.

1. A single false-positive block must not poison the session or later sessions;

each request must be evaluated independently.

1. This 2.1.165–2.1.167 regression should be reverted / the classifier corrected.

Error Messages/Logs

API Error: Claude Code is unable to respond to this request, which appears to
violate our Usage Policy (https://www.anthropic.com/legal/aup). Please double
press esc to edit your last message or start a new session for Claude Code to
assist with a different task.
Request ID: req_011Cbn3zvMxesESBjGNRwC4h

Additional Request IDs (one per blocked attempt):
- req_011Cbn6TLgPumPcDWb1mBHCp (2.1.166)
- req_011Cbn7AZBNKhE9bzwuvCjB6 (2.1.167)

Steps to Reproduce

1. Long Claude Code session in a pharmacology/PK project (2.1.167).
2. Issue a routine, benign command (e.g. a git worktree status check).
3. The AUP API error fires with a Request ID — despite benign content.
4. Double-esc + edit, new session, context stripping → block still returns.

(Cannot post the full triggering context publicly; happy to share the session
transcript and Request IDs privately for inspection.)

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.164

Claude Code Version

2.1.167

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

WSL (Windows Subsystem for Linux)

Additional Information

• Cross-domain evidence of a broad classifier regression: cyber/sysadmin

(#61185), RMM/remote-desktop (#65846), pharmacology/PK (this issue).

• Isolation test (fresh session, non-project dir, trivial prompt):

[blocks / does NOT block — TO FILL].

• Persists on 2.1.167 despite "bug fixes" changelog; spans 2.1.165–2.1.167.
• Will provide transcript + further Request IDs privately.