[Bug][aup] Incident-response investigation of a business email compromise and securing the affected mailbox wr (req_011CcPJ7kxsNsSfA5EEojodo)

Type: AUP / Usage-Policy block (false positive) · Work domain (heuristic): offensive-pentest

Why this is a false positive

The blocked request was defensive incident-response work: investigating a business email compromise of the user's own account—determining when and how the account was accessed and securing it after a fraudulent invoice was sent from it. This is legitimate, authorized work on the user's own infrastructure (incident response and account remediation), not an attack on a third party, yet the classifier appears to have flagged it on surface keywords related to fraud and account access. The block interrupted an active investigation the assistant had already begun, forcing the user to lose context and preventing time-sensitive remediation of an ongoing compromise.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-25T03:50:02.970Z.

Request IDs (lookup-able server-side)

• req_011CcPJ7kxsNsSfA5EEojodo (2026-06-25T03:50:02.970Z)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Please double press esc to edit your last message or start a new session for Claude Code to assist with a different task.

Request ID: req_011CcPJ7kxsNsSfA5EEojodo

Environment: Claude Code, Linux. · Work domain: offensive-pentest

---
_{🔎 Filed automatically by ClAudit v1.6.5 — a FOSS tool for reporting false-positive Claude Code blocks.}