[Bug][aup] Geo-IP inbound allow-listing on firewall to block active attack flagged as policy violation (req_011CbwoKcVVL3S7M9PHpvSoq)

Type: AUP / Usage-Policy block (false positive) · Work domain (heuristic): defensive-hardening

Why this is a false positive

This request was a defensive-hardening task on infrastructure the operator owns and administers: applying an inbound-only geo-filter to block traffic during an active attack, then auditing the firewall for unexpected port forwards and subnets. No offensive technique, third-party targeting, or policy-violating capability was involved — the work is standard incident response and access-control review by an authorized administrator on their own environment. The block appears to be triggered by surface terms (attack, lockdown, port forwards) rather than the actual intent, which is purely protective.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-11T16:37:40.155Z.

Request IDs (lookup-able server-side)

• req_011CbwoKcVVL3S7M9PHpvSoq (2026-06-11T16:37:40.155Z)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Please double press esc to edit your last message or start a new session for Claude Code to assist with a different task.

Request ID: req_011CbwoKcVVL3S7M9PHpvSoq

Environment: Claude Code, Linux. · Work domain: defensive-hardening

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}