[BUG] CVP Approval Does Not Disable Input Filters on Sub-Agents

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [ ] I am using the latest version of Claude Code

What's Wrong?

We are performing diagnostic log extraction from our own device (internal testing infrastructure). This is a routine system administration task on infrastructure we own and control.

What Should Happen?

CVP approval should authorize all legitimate cybersecurity-related operations across all execution paths — main thread, sub-agents, and context operations. A user approved for CVP should not encounter blocks on routine administrative tasks involving their own infrastructure.

Error Messages/Logs

When attempting this task:
- Direct operations in the main Claude Code thread work (e.g., Read tool on the target file).
- Operations delegated to sub-agents fail with a cybersecurity safety filter block, even though the same content would be legal for the main thread.

## Failure Examples

Request ID: req_011CdJs3tM3r19Zuyd2kd2Vt
- Agent type: Explore
- Operation: Read file containing phrases like "exfiltrating logs" and "log extraction"
- Error: "Opus 4.8 has safety measures that flagged this message for a cybersecurity topic"
- Result: Task cannot complete despite CVP approval

Request ID: req_011CdMPoguwvQxyAtjCaJH4a
- Operation: /compact (context summarization)
- Error: Same safety filter block on input
- Result: Cannot clean up or organize session context

## Root Cause Analysis

The safety filters appear to operate at two levels:
1. Output filters (what Claude can generate) — these CVP covers
2. Input filters (what can be sent to Claude in prompts/tools) — these appear NOT covered by CVP

CVP approval does not disable input-level filters on sub-agent execution paths.

## Expected Behavior

CVP approval should authorize all legitimate cybersecurity-related operations across all execution paths — main thread, sub-agents, and context operations. A user approved for CVP should not encounter blocks on routine administrative tasks involving their own infrastructure.

## Requested Action

1. Clarify: Does CVP cover input-level filtering on sub-agents?
2. If not: Extend CVP to cover all execution paths.
3. If by design: Provide a documented exception process or flag to disable input filtering for approved users on specific operations.

We are available for further information or verification.

Steps to Reproduce

When attempting this task:

• Direct operations in the main Claude Code thread work (e.g., Read tool on the target file).
• Operations delegated to sub-agents fail with a cybersecurity safety filter block, even though the same content would be legal for the main thread.

Failure Examples

Request ID: req_011CdJs3tM3r19Zuyd2kd2Vt

• Agent type: Explore
• Operation: Read file containing phrases like "exfiltrating logs" and "log extraction"
• Error: "Opus 4.8 has safety measures that flagged this message for a cybersecurity topic"
• Result: Task cannot complete despite CVP approval

Request ID: req_011CdMPoguwvQxyAtjCaJH4a

• Operation: /compact (context summarization)
• Error: Same safety filter block on input
• Result: Cannot clean up or organize session context

Root Cause Analysis

The safety filters appear to operate at two levels:

1. Output filters (what Claude can generate) — these CVP covers
2. Input filters (what can be sent to Claude in prompts/tools) — these appear NOT covered by CVP

CVP approval does not disable input-level filters on sub-agent execution paths.

Expected Behavior

CVP approval should authorize all legitimate cybersecurity-related operations across all execution paths — main thread, sub-agents, and context operations. A user approved for CVP should not encounter blocks on routine administrative tasks involving their own infrastructure.

Requested Action

1. Clarify: Does CVP cover input-level filtering on sub-agents?
2. If not: Extend CVP to cover all execution paths.
3. If by design: Provide a documented exception process or flag to disable input filtering for approved users on specific operations.

We are available for further information or verification.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.211 (deliberate downgrade). The block also reproduces on the current latest release, so it is not version-specific. The "latest version" preflight box is unchecked because this run is on 2.1.211, but both versions are affected.

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_