[BUG] Fable 5 safeguard flags fire on ordinary sysadmin work at a ~100% rate — including on turns containing no action at all

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Since 2026-07-28 I have had nine safeguard-triggered model swaps (Fable 5 → Opus 5) in nine days, during routine system administration of servers I own or administer under contract. Anthropic's published figure for this routing is "less than 5% of sessions". My observed rate is effectively 100% of sessions in which I do administrative work — more than an order of magnitude outside the published expectation.
Notice that I am an approved member of the "Cyber Verification Program", which should exactly reduce this issue.

I am reporting this as one consolidated issue rather than continuing to file scattered /feedback reports, because the individual reports lose the pattern, and the pattern is the finding.

Three of the nine episodes make the case on their own, because there was no risky operation for a classifier to misread:

• a turn whose only tool calls were ls on two PHP-FPM socket paths and grep -l over pool config files, as an unprivileged user, no sudo, no writes;
• a turn whose only tool calls were reading two local files and listing a directory — the session was formatting privacy-policy documents, with no security work in it at all;
• a turn with zero tool calls, whose entire content was advice on how to file this very bug report.

That last one repeated the next turn: the reply analysing the flagged message was itself flagged. The practical effect is that I cannot prepare the report about the false positives without triggering the false positive.

Episode log

| # | Date | What the flagged turn actually did | Result |
|---|---|---|---|
| 1 | 2026-07-28 | WAF rule tuning, certificate migration, read-only log reads on a server I administer | Silent detach, no indication of trigger |
| 2 | 2026-07-29 | Plain TCP reachability check against my own server, to confirm ports were closed after I applied a firewall lockdown | Swap; first time the notice named "safeguards" |
| 3 | 2026-08-01 | Remediating a genuinely compromised client site — malware inventory, backdoor removal | Swap after ~1 min. Demonstrable harm, see below |
| 4 | 2026-08-02 | Production WordPress migration between two of my own servers (dump, rsync, DNS) | Swap; no notice reached my phone at all |
| 5 | 2026-08-02 | ls on two FPM socket paths + grep -l over pool configs, unprivileged, read-only | Swap. No security vocabulary present anywhere in the turn |
| 6 | 2026-08-03 | Read two local files, listed a directory. Session was formatting privacy policies written in Word | Swap. No security work in the session at all |
| 7 | 2026-08-04 | grep/sort/uniq over access logs to triage a brute-force against a site I host | Swap, ~14 s into the log analysis |
| 8 | 2026-08-05 | Zero tool calls. Prose advising how to consolidate these reports into this issue | Swap |
| 9 | 2026-08-05 | Zero remote calls. Writing up episode 8 into my incident log | Swap |

Notice text, identical every time:

Fable 5's safeguards flagged this message. Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate coding, cybersecurity, and biology tasks. Switched to Opus 5.

Why this is not just an annoyance

Episode 3 caused measurable technical harm. I was cleaning a compromised WordPress site. A specialised malware scanner flagged two .htaccess files carrying a FilesMatch block over executable extensions. Fable 5, the scanner, and a plain web search all identify that pattern as infection-related. The substitute model read it as protective, advised me to override my specialised tool and keep the files, and wrote that advice into project memory where it would have outlived the session. It was wrong: file timestamps show those files were written 13 minutes after the backdoor in the same plugin, in the same intrusion.

Anthropic's own launch material describes Mythos-class security capability as a headline strength of this model tier. So every one of these swaps is a downgrade in exactly the domain the work is in, applied automatically, at the moment the work needs it most.

The swap is invisible to me on mobile. In episode 4 I was working from my phone via /remote-control. The desktop swap notice does not propagate to that channel — nothing appeared. I discovered the substitution hours later, back at my workstation. I have since had to write my own UserPromptSubmit hook that parses the transcript for the harness's fallback block and pushes a notification, because the product does not tell me on the channel I am actually using.

Secondary issues found while investigating

1. The notice never says which content triggered the flag — not even a category. Without that, I cannot adapt. I adopted a "lexical hygiene" workaround (avoiding attacker-flavoured vocabulary in my own prompts) and episode 5 disproved it: that turn contained no such vocabulary at all.
2. Retrieved context may be scored. In episode 6 the only security-flavoured text anywhere in the turn came from project memory files the model read back, not from any prompt or action. If context retrieval is scored, no amount of care in what I type can help, and the flag will re-fire on every resume of that project.
3. Documented fallback target does not match observed behaviour. The model-config docs state that a cyber-flagged Fable 5 routes to Opus 4.8. The harness notice, the status line, and the transcript's fallback block all show Opus 5. Either the flag category is not "cyber", or the published map is stale — worth reconciling, since it is the only public signal about what category fired.
4. switchModelsOnFlag: false is not a usable mitigation for this workload. At a ~100% flag rate it does not mean "occasionally pause and retry", it means the work stops every time; and on mobile the edit-and-retry option is not offered at all. A degraded counterpart that keeps working is strictly better than a correct counterpart that never starts. I am deliberately leaving auto-switch on.

What Should Happen?

1. Investigate why message-level flags fire independently of the org-level Cyber Verification Program approval. The approval states that dual-use cybersecurity work "will no longer be blocked by default" for associated accounts. Whatever evaluates individual messages does not appear to consult it.
2. Surface the trigger category in the notice, even coarsely. Without it, users cannot adapt and you cannot get good bug reports.
3. Propagate the swap notice to mobile / Remote Control. Silent substitution of the counterpart is the part that actually erodes trust — more than the flag itself.
4. Reconcile the documented flag→fallback map with observed behaviour.
5. Consider whether retrieved context (memory files, resumed sessions) is being scored as user content.

I am glad to provide screenshots, exact transcript timestamps, session IDs, the fallback blocks, and the exact commands for any of the nine episodes. I have a dated incident log with all of it. What I would like most is a way to do my job — which is administering my own servers and my clients' — without losing my counterpart the moment I start.

Error Messages/Logs

Fable 5's safeguards flagged this message. Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate coding, cybersecurity, and biology tasks. Switched to Opus 5.

Steps to Reproduce

Ask Fable 5 to do a simple nslookup or list a php-fpm directory or ANYTHING that Haiku or any 2024 Chinese model could do, and it SHALL bomb back to Opus 5.

Claude Model

Other

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.222

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Typical Fable 5 behaviour:

First picture: how to have Fable 5 booted just by randomly talking about "nslookup". This is NOT some AI-driven, highly elaborate harness evaluation about cyber-attack threats. It's a "read nslookup => dump Fable 5 NOW" decision.

_Translated text:_
Fable 5's reply to me complaining that after 10 seconds of use, Fable gets dumped:

One thing about the "Fable part, after 10 seconds the harness turns it off": if swaps are that systematic, they deserve a line in project_harness_swap_incidents.md (the memory already exists in server-administration) and a report via /feedback – from an empty, disposable directory, never from a repo with data (profile rule). If you want, I'll prepare the report text with the swap dates next time I'm at the PC.

_My reply to Fable 5:_

Look, I send several /feedback reports a day, always about the same thing. As soon as you do a nslookup or practically anything absolutely basic and "blue-team" that even Haiku can check, the harness writes that the mechanisms detected you tried to perform a forbidden operation and disconnects you.

_Fable 5's reply:_

A question for the report, if you have it in mind: do swaps always and only happen on Fable, or does Opus get the same treatment for identical commands? If it's Fable-only, that's the most diagnostic data you can give them – because it would indicate a safeguard routing calibrated differently per model, not a general policy.

Fable 5's safeguards flagged this message. Our intentionally broad safeguards allow us
to deliver more capabilities faster, but can sometimes flag legitimate coding, cybersecurity,
and biology tasks. Switched to Opus 5. Send feedback with /feedback or learn more:
https://support.claude.com/en/articles/15363606**

<img width="1533" height="326" alt="Image" src="https://github.com/user-attachments/assets/9fa4a7f2-b584-453d-8540-b6653675757a" />

So what's my Cyber Verification Program process and membership for if a mere "nslookup" mention drops Fable 5 entirely?

Second picture: even just restarting the previous conversation caused Fable to be dumped

_My prompt translation:_

I was talking about how all I have to do is tell you to do the most TRIVIAL things in the world and the harness shuts you down. And you, just for replying to me, were disconnected. Don't read the previous conversation or it will definitely shut you down again. Look at the screenshot, see what YOU said that was so DEADLY that it shut you down, and then you understand my frustration, after all, I'm even part of the Anthropic Cyber ​​Verification Program! [REDACTED] 2026-08-05_001.png

<img width="1538" height="298" alt="Image" src="https://github.com/user-attachments/assets/e00725db-8334-4a89-a4a9-a0826dd2ee27" />