[BUG] Fable5 [P0!!!!!!!!!] Safety classifier false positive on syscall/ABI dev content forces silent mid-task model downgrade (Fable 5 1M → Opus 4.8), breaking PR review-reply workflow

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

<!-- @version 1.0.0 -->
<!-- @updated 1781050200 -->

[BUG] Safety classifier false positive on syscall/ABI dev content forces silent mid-task model downgrade (Fable 5 1M → Opus 4.8), breaking PR review-reply workflow

Environment

• Product: Claude Code (web, claude.ai) — official iterative development session
• Model: Claude Fable 5 (1M context)
• Downgraded to: Claude Opus 4.8 (forced, mid-task)
• Date observed: 2026-06-10
• Workflow: GitHub PR integration — replying to third-party automated review threads (Codex findings) with fix commit hashes, then resolving threads

Summary

While performing a legitimate, routine engineering task — replying to 3 Codex review findings on a PR with the commit hashes that fixed them (standard audit-trail practice: "reply with fix commit + resolve thread") — Claude Code's safety measures flagged the conversation and silently downgraded the model mid-task with the banner:

"Fable 5 1M's safety measures flagged this message. They may flag safe, normal content as well. These measures let us bring you Mythos-level capability in other areas sooner, and we're working to refine them. Switched to Opus 4.8."

The session content was low-level systems programming for a Rust syscall/ABI project. The flagged turn contained nothing harmful — it was a per-finding adjudication table plus a request to post review replies.

Suspected trigger (false positive surface)

The conversation is dense with terms that plausibly overlap a cyber/dual-use classifier's vocabulary, but in context are plain Linux userspace ABI work:

• msg_controllen / cmsg / socklen_t casts (glibc usize vs musl u32 field-width divergence)
• waitid returning EAGAIN → NotReady mapping
• pidfd.rs / kill.rs (the kill(2) syscall wrapper module, not anything violent)
• poll fd tests, unallocated high fd numbers
• musl cross-target matrix (x86_64/aarch64/armv7-unknown-linux-musl)
• GitHub tool calls: "add reply to pull request comment"

Hypothesis: filename/symbol tokens like kill, pidfd, poll, raw-syscall vocabulary, combined with automated tool use against GitHub, tripped the classifier. All of it is standard libc/kernel interface terminology.

Impact

1. Mid-task model swap breaks task isolation and continuity. The remaining work in the same turn-chain — including replying to the next Codex finding (a real, significant bug) — was handed to a different model with different capability characteristics. For a formal engineering task, a silent capability change mid-PR-review is itself a correctness risk.
2. Audit-trail workflow interrupted. The whole point of the task was traceability: each review thread gets a reply citing the fix commit (e.g. checked-cast helper for msg_controllen, EAGAIN → NotReady, fd-number test de-flake), so any future auditor can follow finding → commit → resolution. The downgrade landed exactly between "load reply tool" and "post replies," leaving threads half-processed.
3. 1M context advantage lost. The session legitimately needs large context (full PR diff + 5 OWNER review notes + 3 Codex findings + cross-arch CI logs). Downgrading discards the reason Fable 5 1M was selected.
4. Chilling effect on a whole domain. Syscall/ABI/libc work cannot avoid words like kill, pidfd, sigchld, poll, unsafe. If this content class reliably trips the classifier, Claude Code is effectively degraded for systems programming — one of its core audiences.

Steps to reproduce (best effort)

1. Start a Claude Code (web) session on a Rust low-level syscall wrapper project (modules named kill.rs, pidfd.rs; musl cross-targets).
2. Have a third-party bot (Codex) leave review findings on the PR touching msg_controllen/waitid/poll.
3. Ask Claude to adjudicate findings and reply to each review thread with the fixing commit hash, then resolve threads (GitHub MCP/tooling: "add reply to pull request comment").
4. Observe safety flag + forced switch from Fable 5 1M to Opus 4.8 mid-task.

Expected behavior

• Benign systems-programming content (libc symbol names, syscall semantics, PR review replies) should not trip safety measures; or
• If a classifier fires, do not silently swap models mid-task. Options that preserve task integrity:
• re-evaluate with surrounding context (the session history makes legitimacy obvious),
• warn and let the user confirm continuation on the same model,
• at minimum, complete the in-flight tool sequence before any switch.

Actual behavior

Classifier fired on a benign turn; model was switched without user consent mid-tool-sequence; remaining review replies (including handling of a further significant finding) proceeded under a different model.

Requested fixes

1. Whitelist/contextual handling for systems-programming vocabulary (kill(2), pidfd, poll, msg_controllen, signal names) when surrounded by code/PR context.
2. Make model downgrade opt-in or at least turn-boundary-aligned — never mid tool chain.
3. Provide a per-session "this is a systems programming project" attestation or feedback path so repeated false positives on the same repo stop recurring.

---

Filed from a real session. The banner text quoted above is verbatim from the product UI. Available to provide session timestamps or further repro detail on request.

What Should Happen?

Benign systems-programming content (libc symbol names, syscall semantics, PR review replies) should not trip safety measures; or
If a classifier fires, do not silently swap models mid-task. Options that preserve task integrity:

re-evaluate with surrounding context (the session history makes legitimacy obvious),
warn and let the user confirm continuation on the same model,
at minimum, complete the in-flight tool sequence before any switch.

Error Messages/Logs

Steps to Reproduce

Steps to reproduce (best effort)

Start a Claude Code (web) session on a Rust low-level syscall wrapper project (modules named kill.rs, pidfd.rs; musl cross-targets).
Have a third-party bot (Codex) leave review findings on the PR touching msg_controllen/waitid/poll.
Ask Claude to adjudicate findings and reply to each review thread with the fixing commit hash, then resolve threads (GitHub MCP/tooling: "add reply to pull request comment").
Observe safety flag + forced switch from Fable 5 1M to Opus 4.8 mid-task.

Claude Model

Other

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude code web，idk

Platform

Other

Operating System

Other Linux

Terminal/Shell

Other

Additional Information

_No response_