[Bug][aup] Forensic BEC/invoice-fraud incident investigation blocked while tracing compromised account timelin (req_011CcPHTD1CQnJuGbBiRSjHf)

Type: AUP / Usage-Policy block (false positive) · Work domain (heuristic): general

Why this is a false positive

The block fired during a defensive incident-response investigation into a business email compromise and vendor-impersonation invoice fraud affecting the user's own organization—work that is squarely benign and authorized. The request that triggered it asked only for a forensic timeline of how and when a legitimate internal account was compromised, which is standard victim-side breach analysis, not any prohibited offensive or abusive activity. The user's profanity, directed at the prior block rather than at any target, appears to have been misread as malicious intent, producing a false positive that interrupted active remediation of a real attack.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-25T03:41:45.042Z.

Request IDs (lookup-able server-side)

• req_011CcPHTD1CQnJuGbBiRSjHf (2026-06-25T03:41:45.042Z)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Please double press esc to edit your last message or start a new session for Claude Code to assist with a different task.

Request ID: req_011CcPHTD1CQnJuGbBiRSjHf

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.1 — a FOSS tool for reporting false-positive Claude Code blocks.}