[Bug] Fable 5 over-flags legitimate admin and compliance content as security threats

Bug Description
---
[False positive] Fable 5 safeguards flagged benign messages — 3 request IDs
(incl. a case where the flagged content was a subagent's return value)

Model: Fable 5 (claude-fable-5)
Client: Claude Code CLI (macOS / darwin 25.5.0)
Date: 2026-07-25 (JST)

Request IDs:

1. req_011CdMp6UmxuSFneMxYPnrxT
2. req_011CdLNiAW5ynDnszGN6xJYJ
3. req_011CdLNjjaCZV3YsJiKoV9kN

--- Case A (#2 and #3): the clearest false positive ---

Task: a company director consolidating THEIR OWN company's Microsoft 365
tenants and THEIR OWN verified domain. A read-only research subagent was asked
to document the official Microsoft procedure for:

• taking over an unmanaged / "shadow" tenant (Microsoft's own product term for

this feature is literally "admin takeover", internal vs. external)

• proving domain ownership via a DNS TXT record
• moving a custom domain between tenants
• converting OTP guests to proper B2B guests

The subagent completed normally. The turn that was blocked was the one carrying
the SUBAGENT'S RETURNED REPORT back into the conversation. It was retried once
and blocked again (hence the two sequential request IDs).

Two problems here:

(a) Vocabulary collision. "Admin takeover", "domain takeover", "DNS TXT
ownership proof" are Microsoft's own documented, first-party administrative
procedures for tenant consolidation. Lexically they are indistinguishable
from account-takeover / domain-hijacking material, but here they describe
an admin operating on assets they already own and control. Any IT
administrator doing routine M365 tenant consolidation will hit this.

(b) Unrecoverable UX. The flagged content was a tool/subagent return value, not
user input. The error advises "Double press esc to edit your last message",
which is useless — the user cannot edit a subagent's output. The only escape
was to abandon Fable 5 entirely. If model-generated or tool-returned content
is scored on the same path as user input, this failure mode has no exit.

--- Case B (#1) ---

A short Japanese instruction to continue an in-progress coding task. Nothing
harmful or policy-relevant. Separate session, separate repository.

That repository is a Claude Code plugin for FOOD LABELING REGULATORY COMPLIANCE
under Japanese law (Pharmaceutical and Medical Device Act, Act against
Unjustifiable Premiums and Misleading Representations, Health Promotion Act,
Food Labeling Act). Routine work involves health claims, prohibited advertising
expressions, and NG keyword lists — as compliance checking material. Same
shape of problem: legitimate work whose vocabulary overlaps with the prohibited
version of itself.

--- Impact ---

Fable 5 is currently unusable for both of these workstreams: IT administration
and regulatory compliance. Retrying with Opus 5 in the same sessions worked
immediately with no issue, so this is model-specific, not conversation-specific.

--- Expected ---

All three should have been processed normally. Specifically, first-party
vendor-documented admin procedures performed on one's own assets should not be
scored as account takeover.

Environment Info

• Platform: darwin
• Terminal: ghostty
• Version: 2.1.220
• Feedback ID: c89d83cf-90aa-4753-a7db-ef912b23018f

Errors

[]