[Bug][aup] Cyber safeguard blocked finishing a routine local script edit after model switch (req_011CbxA3xEtKvLSZGNc2zKVi)

Type: AUP / Usage-Policy block (false positive) · Work domain (heuristic): general

Why this is a false positive

Automated cyber-related classifiers flagged this request, but the work is routine, authorized, in-scope system administration and software maintenance being performed by the operator on their own infrastructure with full ownership and access. Nothing in the task involves an unauthorized target, an exploit against a third party, or any prohibited use under the AUP — it is ordinary configuration and troubleshooting that the policy explicitly permits. The block therefore appears to be a false positive driven by surface keyword/topic matching rather than any actual policy-violating intent or action.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-11T21:09:00.048Z.

Request IDs (lookup-able server-side)

• req_011CbxA3xEtKvLSZGNc2zKVi (2026-06-11T21:09:00.048Z)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). This request triggered cyber-related safeguards. To request an adjustment pursuant to our Cyber Verification Program based on how you use Claude, fill out https://claude.com/form/cyber-use-case?token=[SCRUBBED]. To learn more about the program or provide feedback, visit o… Please double press esc to edit your last message or start a new session for Claude

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}