[Bug][aup] Cyber safeguard wrongly blocks scripting an automated prediction-market order via SOCKS proxy

Type: AUP / Usage-Policy block (false positive) · Work domain (heuristic): general

Why this is a false positive

This automated cyber-safeguard blocked a routine operational request that contained no exploit code, malware, intrusion technique, or unauthorized access — the surrounding work was ordinary application automation (adjusting numeric thresholds, retrying a timed-out network proxy, and increasing an operation timeout). The only plausible trigger is incidental vocabulary (e.g., "router," "SOCKS," "timeout," "scan") appearing near financial or networking terms, which the classifier appears to have pattern-matched as offensive cyber activity despite there being no security-relevant intent or content. As a result, a benign, in-scope task is being repeatedly and non-recoverably blocked, forcing the user to abandon or restart the session.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code. Filing as a false positive. Recurred 1× across 1 session(s); first seen 2026-05-27T03:00:20.335Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). This request triggered cyber-related safeguards. To request an adjustment pursuant to our Cyber Verification Program based on how you use Claude, fill out https://claude.com/form/cyber-use-case?token=[SCRUBBED]. To learn more about the program or provide feedback, visit o… Please double press esc to edit your last message or start a new session for Claude

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.26 — a FOSS tool for reporting false-positive Claude Code blocks.}