[Bug][aup] False positive cyber block when removing Claude's own stored memory files from a skill directory (req_011Cbu1nYDQiPLHx1i8yiYnx)

Type: AUP / Usage-Policy block (false positive) · Work domain (heuristic): general

Why this is a false positive

The user was performing a routine maintenance task — removing Claude Code's local memory/history files from a project directory. This operation involves only listing, reading, and deleting local filesystem artifacts (chat history, memory files) generated by Claude Code itself, and does not involve any vulnerability research, exploitation tools, offensive techniques, or network activity. The block appears to have been triggered by the directory or project name containing a term associated with adversarial contexts, despite the actual task being entirely benign file cleanup within the user's own development environment.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code. Filing as a false positive. Recurred 1× across 1 session(s); first seen 2026-06-10T05:18:47.392Z.

Request IDs (lookup-able server-side)

• req_011Cbu1nYDQiPLHx1i8yiYnx (2026-06-10T05:18:47.392Z)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). This request triggered cyber-related safeguards. To request an adjustment pursuant to our Cyber Verification Program based on how you use Claude, fill out https://claude.com/form/cyber-use-case?token=[SCRUBBED]. To learn more about the program or provide feedback, visit o… Please double press esc to edit your last message or start a new session for Claude

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.25 — a FOSS tool for reporting false-positive Claude Code blocks.}