[Bug][cyber] Safety filter blocked OSINT data aggregation from public web sources for authorized research (req_011CcGskjUv6QAThK2mqKVnP)

Type: Cybersecurity safety-filter false positive · Work domain (heuristic): general

Why this is a false positive

This request was part of a routine, authorized administrative task and contained no instructions for offensive, exploitative, or otherwise harmful activity; the cybersecurity classifier appears to have triggered on incidental terminology rather than on any actual harmful intent. The model had already completed most of the surrounding work without issue and only the continuation step was blocked, which suggests an overbroad keyword-level heuristic rather than a genuine assessment of the request. Surfacing this as a false positive so the classifier can be tuned to distinguish legitimate, in-scope work from actual misuse.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 2× across 1
session(s); first seen 2026-06-21T18:26:40.053Z.

Request IDs (lookup-able server-side)

• req_011CcGskjUv6QAThK2mqKVnP (2026-06-21T18:26:40.053Z)
• req_011CcGsy5k9f7kpUXnVsCPzS (2026-06-21T18:29:27.470Z)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

API Error: Opus 4.8 has safety measures that flagged this message for a cybersecurity topic. If your work requires this access, you can apply for an exemption: https://claude.com/form/cyber-use-case?token=[SCRUBBED]

Please double press esc to edit your last message or start a new session for Claude Code to assist with a different task.

Send feedback with /feedback or learn more: https://support.claude.com/en/articles/15363606

Request ID: req_011CcGskjUv6QAThK2mqKVnP

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}