[Bug][aup] Windows RDS host investigation via WinRM blocked mid-troubleshooting on authorized internal system (req_011CcG5dQPuUKM88PEKRYirV)

Type: AUP / Usage-Policy block (false positive) · Work domain (heuristic): general

Why this is a false positive

The block fired on a legitimate, in-scope task — an authorized internal Windows system investigation requiring remote management access to a managed server — but the conversation immediately preceding it contained profanity and frustration directed at the assistant, not at any target or victim. The classifier appears to have keyed on the hostile tone and the request for remote-access credentials in proximity, reading routine administrative access to one's own managed infrastructure as malicious activity. No policy-violating goal was present: the underlying work was standard sanctioned systems administration, and the surrounding language was venting, not intent.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-21T08:22:10.088Z.

Request IDs (lookup-able server-side)

• req_011CcG5dQPuUKM88PEKRYirV (2026-06-21T08:22:10.088Z)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Please double press esc to edit your last message or start a new session for Claude Code to assist with a different task.

Request ID: req_011CcG5dQPuUKM88PEKRYirV

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}