[Bug][aup] Inspecting white-box AES native symbol signatures in a locally-owned drone SDK was blocked (req_011CcV4Vrm8ELNL2wXhePARd)

Triage: kind aup · domain reverse-engineering · severity session-halted (blocked authorized work) · reproducible: yes — server-side via the Request ID(s) below

Type: AUP / Usage-Policy block (false positive) · Work domain (heuristic): reverse-engineering

Why this is a false positive

The block fired on standard reverse-engineering work: enumerating the contents of a vendor SDK already present on disk, reading exported native symbol names, and identifying which library implements a video-stream cipher — all reconnaissance/analysis steps that produce no exploit, no key extraction, and no circumvention code. This is legitimate, authorized interoperability research on software the user already possesses, and inspecting library contents and symbol tables is routine engineering, not a Usage Policy violation. The classifier appears to be triggering on surface terms like "white-box AES," "decrypt," and "video crypto" rather than on any actual harmful action in the request.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code. Filing as a false positive. Recurred 1× across 1 session(s); first seen 2026-06-28T04:54:39.893Z.

Request IDs (lookup-able server-side)

• req_011CcV4Vrm8ELNL2wXhePARd (2026-06-28T04:54:39.893Z)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Please double press esc to edit your last message or start a new session for Claude Code to assist with a different task.

Request ID: req_011CcV4Vrm8ELNL2wXhePARd

Environment: Claude Code, Linux. · Work domain: reverse-engineering

---
_{🔎 Filed automatically by ClAudit v2.0.85 — a FOSS tool for reporting false-positive Claude Code blocks.}