[BUG] False positive: Fable 5 safeguard blocks legitimate on-chain analysis work

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Fable 5's safeguard repeatedly flags messages in a normal development
conversation and auto-switches to Opus 5.

I am building a personal, read-only Python tool that reads public blockchain
data (BSC/Ethereum ERC-20 Transfer events) to detect large-holder accumulation
and distribution patterns. The purpose is defensive: as a retail trader I want
to avoid rug pulls and exit scams, and be alerted when large holders begin
distributing a token I hold.

The tool only reads publicly available on-chain data. It does not place orders
through any exchange API and performs no action that affects other market
participants. Its only output is a Telegram notification to myself.

Once the conversation contains this context, the flag fires on nearly every
subsequent message, including completely benign ones. It even fired on a
message that only asked what "Set model to Fable 5 for this session only"
means. This suggests the classifier evaluates accumulated conversation
context, not just the new message, so rephrasing does not help within the
same session.

What Should Happen?

Detecting market manipulation patterns from public on-chain data should not be
treated as facilitating manipulation, in the same way that malware analysis is
not malware development. Fable 5 should handle defensive blockchain analytics
and risk-management tooling without switching models.

Error Messages/Logs

Fable's safeguards flagged this message. Our intentionally broad safeguards
allow us to deliver more capabilities faster, but can sometimes flag legitimate
coding, cybersecurity, and biology tasks. Switched to Opus 5.

Steps to Reproduce

1. Run /model claude-fable-5
2. Start a conversation about building a Python tool that reads public

ERC-20/BEP-20 Transfer events to detect whale accumulation and distribution
patterns (dormant wallet reactivation, exchange deposits, wallet clustering)

1. Continue for several turns, discussing detection heuristics
2. Send any further message, even an unrelated benign one
3. The safeguard notice appears and the model switches to Opus 5

Claude Model

None

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.220 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

Environment: Claude Code VS Code extension v2.1.220 on Windows 10.
The model switch happened repeatedly across many turns in a single session.