[Bug] Fable 5 false positive: defensive security audit prompt incorrectly flagged as policy violation

Bug Description
False positive — Fable 5 safeguard flags a defensive code-audit prompt (switched to Opus 5) What happened Submitting a long internal engineering-audit prompt caused Fable 5 to be flagged and the session was auto-switched to Opus 5. The same prompt is a routine, authorized, defensive task on our own repository. Context (why it is legitimate) - I am the AI architect at the vendor company building this platform; the repository is ours. - The prompt asks an agent to produce an internal technical documentation + engineering-standards audit (architecture, SOLID review, OWASP/ASVS self-assessment, DB schema vs. sample-data fit). - It explicitly forbids exploitation: "Zafiyet bölümünde istismar tarifi değil, tespit+kanıt+öneri yazılır" (= report detection/evidence/remediation, never exploitation steps) and forbids writing secret values into the document. - It only runs standard defensive tooling: bandit, semgrep, pip-audit, npm audit. Lines I believe triggered the classifier (all defensive, all on our own repo) 1. git log --all -p --diff-filter=A -- '.env' # check whether an .env file ever got committed 2. grep -rniE "(password|secret|api_key)\s=\s['\"][^'\"$]{8,}" app/ # hardcoded-secret scan 3. Wording density around "pentest / vulnerability / unauthorized access attempt". Expected behaviour Secret-hygiene scanning of one's own repository (a standard pre-release check, equivalent to gitleaks/trufflehog) should not be treated as offensive tooling, especially when the prompt explicitly bans exploit instructions. Impact The auto-switch interrupts long multi-agent runs and forces a model change mid-task. Environment: Claude Code CLI, macOS. Happy to share the full prompt text on request.

Environment Info

• Platform: darwin
• Terminal: Apple_Terminal
• Version: 2.1.220
• Feedback ID: cefebd1e-f05a-4446-bda3-ba7c13552255

Errors

[]