Safety classifier kills sessions silently mid-turn — no error shown, no error logged, usage still burned (researching news coverage of the HF breach)

Summary

Researching a major current news story (the OpenAI / Hugging Face breach disclosed 16–21 July) caused three consecutive sessions to be silently killed mid-turn by what appears to be an upstream cyber-content safety classifier. No error was shown in the UI, no error was written to the session transcript, and the consumed usage was not credited. From the user's side the product simply goes silent, which is indistinguishable from deliberate censorship and — given this particular story is about guardrail false positives blocking defenders — a genuinely terrible look.

This report is about the failure UX, not a request to relax the classifier.

Environment

• Claude Code 2.1.217, Linux (Arch), Max 20x plan
• Model: claude-fable-5 (settings-pinned)
• Sessions (local IDs, timestamps UTC, 2026-07-22): 888dfb3b (~20:52–20:59), 6087107d (~21:00–21:07), and a third session investigating the first two, killed the same way

What happened

1. User asked a normal current-affairs question about the OpenAI/Hugging Face incident ("is it marketing, why did HF use an open-weight model, what is the trusted-access scheme"). Claude fanned out web research. Articles covering this story quote attack commands and forensic artefacts verbatim; once fetched into context, subsequent API requests were killed.
2. Retrying in a fresh session reproduced the kill after the same fetches.
3. A third session that merely grepped the earlier transcripts to diagnose the problem re-ingested the quoted material and was killed the same way. Sessions containing the material are permanently poisoned — every later request in them can re-trip the block, including unrelated ones.

Analysis-level discussion of the story passes fine (a full critical summary was delivered in session 6087107d). Only turns whose context contained verbatim quoted attack material were killed. The user's own prompts were never the trigger.

Forensic signature in the transcript

The block leaves no error record:

• Session ends immediately after a tool_result entry; the follow-up assistant message never arrives, or
• The CLI injects a synthetic placeholder:

{
  "type": "assistant",
  "message": {
    "model": "<synthetic>",
    "stop_reason": "stop_sequence",
    "stop_sequence": "",
    "content": [{"type": "text", "text": "No response requested."}],
    "usage": {"input_tokens": 0, "output_tokens": 0}
  },
  "isApiErrorMessage": false
}

Nothing is rendered to the user. No isApiErrorMessage: true entry, no system entry, no stderr output. The user's literal experience was asking a news question three times and watching the assistant vanish mid-sentence, three times, with tokens consumed each time.

Why this UX is the bug

A silent kill and deliberate censorship produce identical observable evidence: silence. The user in this case (reasonably) concluded Anthropic was suppressing a story embarrassing to the AI industry. The transcript evidence shows it was a content classifier false positive — but the user had no way to know that, and most users have no way to run transcript forensics. Opacity converts every false positive into perceived malice.

The irony should be noted internally: Hugging Face's own incident write-up says commercial guardrails "cannot distinguish an incident responder from an attacker," which is why they moved forensics to a self-hosted open-weight model. A paying customer then hit the same failure mode for reading the news coverage of that exact complaint.

Asks

1. Surface the block. When an upstream classifier terminates a request, render a visible, honest error in the CLI ("This response was stopped by a safety filter" + a category), and write it to the transcript as an error entry. Never fail silently.
2. Don't charge for killed turns. Classifier terminations should not burn plan usage; other providers credit refusals of this class.
3. Session recovery guidance. If a session's context is poisoned for the classifier, tell the user, so they don't burn two more sessions rediscovering it empirically.
4. Intent handling for news/defensive contexts. Longer-term: quoted attack material arriving via WebFetch of mainstream news coverage is a strong signal of reading, not attacking. At minimum, the model's own summarisation of such sources shouldn't inherit the block.

No verbatim quoted material from the underlying articles is included in this report, for obvious reasons.