[BUG] Safeguard false-positive: model-distillation content classifier fires on vocabulary, not model identity
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
Summary
In a long session doing legitimate model fine-tuning, the auto-mode tool-safety path began failing with toolDenialKind: "automode-unavailable" and silently routing the session from the selected model (Fable 5) to Opus. Root cause appears to be a content classifier firing on the vocabulary/pattern of model distillation — not on what any command does, and not on the identity of the models involved.
Impact
When it trips, every tool call — including local read-only ones — either denies or forces the turn onto Opus.
Evidence it's content-based (not command-based):
- A plain-text message containing only a hypothesis about the safeguard — no tool call — tripped it. Reproduced twice.
- 4 of 9 observed trips were preceded by local-only file-read commands.
- Trips track distillation execution, not discussion: 0 trips on a day with 55 distillation-vocabulary turns (discussion + toy dry-run), then 7 trips on the one day the at-scale teacher-labeling + real training executed (119 vocabulary turns).
Why it's a false positive
The pipeline distills DeepSeek (teacher) → Gemma (student). No Anthropic model is teacher or student. The classifier matches the shape of distillation work without checking that an Anthropic model is involved.
Diagnostics: jq queries + the analyze_safeguard_trips.py analyzer are in the file (mine the session .jsonl for automode-unavailable denials and Fable→Opus fallbacks).
What Should Happen?
Safeguard should key on model identity rather than on training related vocabulary.
Error Messages/Logs
Steps to Reproduce
Reproduction may be difficult. Before today (2026-07-18), I ran several turns with Fable to develop an initial training data set and Claude Code ran optiq lora... without issue.
Today, Claude tripped the safeguard by tailing a file that contained TRAINING=1. In a new session, a tool call to tail a similar file did not trip the safeguard, but the Claude Response about not tripping the safeguard for training and distillation DID trip the safeguard.
Claude Model
Other
Is this a regression?
I don't know
Last Working Version
_No response_
Claude Code Version
2.1.199 (Claude Code)
Platform
Anthropic API
Operating System
macOS
Terminal/Shell
Terminal.app (macOS)
Additional Information
_No response_