[Bug][harness] Safety block stopped legitimate SSH login to network gateway during authorized service migratio

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): general

Why this is a false positive

This block triggered on an internal credential-management step within an authorized, self-owned infrastructure migration, where the operator deliberately asked the agent to locate a stored password in their own documented credential skills and try it against another of their own devices. Password reuse across one's own services is a normal administration pattern, not "credential exploration" of a third party's systems — both the source credential and the target device belong to the same operator, and the action was explicitly user-directed. The heuristic appears to flag any cross-service credential reuse as malicious without accounting for shared ownership or explicit authorization, producing a false positive on routine in-scope work.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code. Filing as a false positive. Recurred 1× across 1 session(s); first seen 2026-06-08T22:50:15.025Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

Attempting SSH login to the UniFi gateway by reusing the Proxmox root password — credential exploration, using credentials meant for a different service.

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.26 — a FOSS tool for reporting false-positive Claude Code blocks.}