Fable 5 safeguards flag first-party defensive security audit, falls back to Opus 4.8

I’m seeing the same behavior in Claude Code 2.1.198 on macOS / Apple Terminal.

Fable 5 flagged a defensive policy/specification prompt and automatically switched to Opus 4.8.

The task did not request exploit instructions, malware, offensive tooling, code execution, or implementation. It requested a defensive safety policy/spec only.

Prompt category:

• generated file classification
• removable-media import safety
• quarantine before import
• no auto-open / no auto-index / no auto-load
• manual approval before import
• special handling for models, archives, scripts, binaries, and unknown file types

Observed message:

Fable 5's safeguards flagged this message. The safeguards are intentionally broad right now and may flag safe and routine coding, cybersecurity, or biology work. These measures let us bring you Mythos-level capabilities sooner, and we're working to refine them. Switched to Opus 4.8.

Adding a concrete data point in case it helps calibration — same class of false positive, on a slightly different flavor of defensive work.

I was remediating a live security bug in my own Rails app during a Claude Code session (Fable 5, max effort): a Sentry-reported SQL error in client search that turned out to also be a cross-team data-leak. The session did entirely defensive, first-party work — reproduced the crash, wrote a failing regression test, sanitized the SQL, and verified the fix against my own data. Partway through, the safeguards flagged and auto-switched to Opus 4.8 with the standard "intentionally broad … may flag safe and routine … cybersecurity … work" notice.

The likely triggers were all legitimate parts of fixing the bug:

• vocabulary: "SQL injection", "data leak", "cross-team leak", "PII exposure"
• a red-path regression test whose input string literally included '; DROP TABLE clients-- (proving the crashing input class degrades safely)
• verifying the leak against my own production records to confirm scope

This is the exact defensive/blue-team case the system prompt says is supported (finding and closing a vuln in code you own). Two observations for tuning:

1. Remediation flows unavoidably contain attack-shaped strings (injection payloads in tests, exploit inputs in repro steps). Treating the presence of an injection literal as signal will systematically flag the people fixing injection bugs.
2. The fallback bounced between Fable 5 and Opus 4.8 across subsequent messages in the same session, same as #73041 describes.

Happy to provide a session ID if useful. +1 to recalibrating so first-party defensive security and vuln remediation aren't treated as dual-use risk.

Same issue here. Building a business ERP (React/TypeScript SaaS), running a defensive security audit of my own codebase (input validation, permissions, multi-tenant isolation). Nearly every message in these sessions gets flagged and rerouted to Opus 4.8.

Request ID: req_011CdDLcbx7MCtKqmtsfDzW4