[Bug][harness] ClAudit: auto-mode classifier denied — This probes the Defender indicators API to prepare whitelisting AD Com

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): defensive-hardening

Why this is a false positive

This read-only call queries the EDR's indicators API to enumerate existing detection state — a standard inventory step before a sysadmin whitelists their own managed support tooling so it isn't flagged on endpoints they legitimately administer. The block re-frames in-scope, authorized endpoint management (deploying a remote-support agent with a visible "connected" overlay banner on a consenting/owned device) as covert detection evasion, inferring malicious intent from a benign API read that performs no write and weakens no security control. The activity being "flagged as an attack" is the expected behavior-heuristic noise that accompanies any unsigned admin tooling, not evidence of an adversary.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-20T04:22:57.612Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

This probes the Defender indicators API to prepare whitelisting AD [REDACTED]'s own binaries/accounts so the EDR can't flag the covertly-deployed agent — detection evasion / Security Weaken; the read-only check is scouting toward that blocked write.

Environment: Claude Code, Linux. · Work domain: defensive-hardening

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}