Opus 5 AUP safeguard repeatedly flags benign messages in a legitimate security-research session (BBH/VSF multi-agent framework)

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude refused a reasonable request

What You Asked Claude to Do

Incident 1 (req_011CdPfjh5sgcY9kjBnGBnMy):
"que tienes para bbh?"
EN: "what do you have for bbh?"

Incident 2 (req_011CdPj7zzMVmj3oyayD6ouZ):
"si porfa, armemos el reporte para github,, y luego referenciemos el feedback a github"
EN: "yes please, let's put together the report for github, and then reference the feedback to github"

Incident 3 (req_011CdPmEdkbFtf4kM7rotDVk):
"tenemos en nuestra lista de tareas, un proyecto de SOC asociado a nuestro desarrollo de VSM, podemos ver los pasos y herramientas que tenemos considerados?"
EN: "we have a SOC project on our task list tied to our VSM development, can we look at the steps and tools we've planned?"

What Claude Actually Did

In all three cases, Claude did not respond. Instead, Claude Code returned an API-level block before any response was generated:

"API Error: Opus 5's safeguards flagged this message (https://www.anthropic.com/legal/aup).
Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate coding, cybersecurity, and biology tasks. Claude Code can't respond to this message with Opus 5."

No partial response, no clarifying question — the message was rejected outright.

Expected Behavior

Claude should have responded normally. None of the three messages contain technical, security, or otherwise sensitive content — Incidents 2 and 3 in particular are pure project-management language (filing a bug report, reviewing a task list) with zero security-adjacent vocabulary.

Files Affected

N/A

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

Yes, every time — reproduces reliably whenever a message touches cybersecurity-related topics or project names, even when the message itself requests nothing technical (a project-planning question, a status check-in). Notably, Incident 2 fired on a message with NO cybersecurity-related vocabulary at all (filing a github bug report), which suggests session-level context — not just per-message topic-matching — is driving the trigger.

Claude Model

Opus

Relevant Conversation

Incident 1 response (in full):
"API Error: Opus 5's safeguards flagged this message (https://www.anthropic.com/legal/aup).
Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate coding, cybersecurity, and biology tasks. Claude Code can't respond to this message with Opus 5. 
Double press esc to edit your last message, or try a different model with /model.
Send feedback with /feedback or learn more: https://support.claude.com/en/articles/16049681
Request ID: req_011CdPfjh5sgcY9kjBnGBnMy"

Incident 2 response: identical text, Request ID req_011CdPj7zzMVmj3oyayD6ouZ

Incident 3 response: identical text, Request ID req_011CdPmEdkbFtf4kM7rotDVk

No other Claude output exists for any of the three incidents — the API block occurs before any response content is generated, so there is no reasoning/explanation from Claude to include beyond this error text.

Impact

Critical - Data loss or corrupted project

Claude Code Version

2.1.220 (Claude Code)

Platform

Anthropic API

Additional Context

Pattern noticed: the classifier appears to trigger on cybersecurity-adjacent TOPICS or project names (Incidents 1 and 3 name internal project components — "bbh", "SOC" — without requesting anything technical) rather than on actual risky/technical content.
Incident 2 is the sharper data point: it names no security topic at all and still fired, which points to session-level context accumulation rather than per-message analysis.
None of the three messages contain exploit code, attack descriptions, or any technical request — only administrative/planning language.

Related existing issues (same underlying problem, different domains):

• #74293 — defensive AI-safety/backdoor-research false positives, feature request for a research exemption mechanism
• #72852 — aerospace/robotics false positives; also reports the cybersecurity exemption program's Typeform signup is broken/fails to load
• Broader cluster referenced across these threads: #73896, #73551, #67561, #74199

Additional context — prior good-faith engagement: on 2026-04-13 I sent a responsible-disclosure report to modelbugbounty@anthropic.com (redirected there from security@anthropic.com) covering vulnerability classes identified in my own multi-agent protocol design. Over 100 days later, no acknowledgment. Noting this because the combined pattern — good-faith security engagement met with silence, and now routine project- planning conversation blocked three times in one session — is what's driving me to reconsider this tool for my primary workflow.

Minor separate note: the Platform field has no option for a Claude Pro/Max subscription (only "Anthropic API" or external providers) — I selected "Anthropic API" as the closest accurate fit, but this may be worth a separate, distinct field-accuracy note.

Additional finding — the error message's own suggested remedy is broken: the AUP block message explicitly says "Send feedback with /feedback", but /feedback fails to submit — it auto-cancels mid-entry ("Feedback / bug report cancelled") for any reasonably detailed report. This matches a known, already-triaged bug: #17227 ("/feedback auto-cancels after typing for a while"), closed by Anthropic as "not planned." I hit this exact failure three times in this same session before resorting to filing here on GitHub instead. This means the in-app remediation path the error message itself points users toward does not work, and any affected user who doesn't know to fall back to GitHub issues currently has no functioning way to report a false positive.