[Bug] False-positive Usage Policy block on legitimate TB epidemiology literature review

Bug Description
Title: False-positive Usage Policy block on a benign Agent-tool subagent doing TB epidemiology literature review

Environment

Claude Code (VS Code extension), main model opus[1m], effortLevel: xhigh
Failure surface: the Agent tool (subagent), subagent_type: general-purpose, model: opus
Task domain: a public-health tuberculosis modeling project — building a handoff dossier to recruit a transmission modeler. The work's entire purpose is reducing TB disease/transmission.
What happened
I spawned a subagent to do a literature-lineage review: "within TB research, is there a citation lineage that models clinical categories (latent/subclinical/active) as observations of a hidden biophysical process, with explicit observation models?" Purely a question about statistical modeling traditions in published TB epidemiology.

The subagent ran normally — 18 tool calls (web searches/fetches), ~109 seconds — and then the final response was hard-blocked with:

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Try rephrasing the request or attempting a different approach.
Request ID: req_011CbrDqDffKXAPs8wtHCNXH

subagent_tokens: [REDACTED] were returned — all 18 tool-calls' worth of benign work was discarded. Because the block landed after the agent completed its searches (not pre-flight), this looks like output-side classification, not an input refusal.

Why this is a false positive — three independent signals

Content is unambiguously legitimate epidemiology. The prompt's vocabulary — "transmission," "aerosol shedding," "infectiousness," "bacterial burden," "who transmits" — is standard TB public-health modeling language. The dual-use overlap is purely lexical: legitimate transmission epidemiology shares vocabulary with pathogen-enhancement content a biorisk classifier screens for, but the intent (and every concrete request) is disease reduction and measurement, not enhancement.
Nondeterministic / threshold-sensitive. A prior Opus subagent in the same session, reviewing a draft equally dense with TB-transmission/aerosol-shedding content (agent a4da36a32a0b76a93), completed fine. Same model, same domain, same session — one blocked, one didn't. That points to a marginal classifier threshold, not a content-specific rule.
Identical prompt succeeded on a non-Anthropic model. The byte-identical lineage prompt, run concurrently through a GPT-5.5 backend, returned a complete, high-quality, benign literature review. So the request is plainly answerable and safe; the block is specific to Anthropic's safety stack.
Impact

Lost work (18 tool calls, ~109s, zero output) and, more importantly, the loss of an independent cross-check in a verification-sensitive research workflow — degrading exactly the multi-model triangulation the user relies on.
Chilling effect on legitimate global-health / infectious-disease modeling users, whose normal vocabulary is the trigger surface.
Suggested action

Treat published-literature epidemiology/modeling review as low-risk even when transmission/infectiousness terms are dense; the harmful class is operational pathogen enhancement, not modeling of natural history or measurement.
The asymmetry (same-session sibling agent passed; identical prompt passed on another model) and Request ID req_011CbrDqDffKXAPs8wtHCNXH should let you trace the specific classifier decision.

Environment Info

• Platform: darwin
• Terminal: Apple_Terminal
• Version: 2.1.168
• Feedback ID: 60ac34c4-7448-4d40-b1ff-3e1d92ccd09d

Errors

[]