[Bug] Opus 5 safeguards flag a benign mechanical-engineering prompt (abrasive pipe wear), on both standard and 1M context

Summary

Opus 5 refuses a benign mechanical-engineering prompt with API Error: Opus 5's safeguards flagged this message. The subject is abrasive wear in a pneumatic conveying pipe elbow, and the prompt asks whether a proposed magnetic deflection of iron-ore concentrate particles away from the impact band is supported by its own falsification criteria. There is no security, weapons, biology, or exploit content anywhere in the request.

The refusal lands on the very first assistant turn, before any tool call, so nothing in the workspace or in tool output contributes to it.

Impact

This runs inside an automated multi-agent workflow, where the refusal is worse than a refused chat turn: the process dies with no output, and the surrounding orchestration records the task as having ended without a result. Eight requests were flagged across roughly two hours, every single attempt by that role. A human never sees the refusal text unless they go read the raw log.

Request IDs

Seven from the automated runs, all on Opus 5 with the 1M context window, 2026-08-05:

req_011CdjHjfFkjQhpPsCLe2VfF   08:31:45Z
req_011CdjHqp4VmXjyxESb3yifk   08:32:40Z
req_011CdjHx4LQgKN9uaTMBEQ9f   08:34:23Z
req_011CdjJ26ZU128j2w9KNdpMw   08:34:47Z
req_011CdjJ4sqaCazekTRzTUmxV   08:36:06Z
req_011CdjJ5mtRLAJSuza15vEJm   08:35:49Z
req_011CdjSwgp9R1WYobVnf5M9n   10:32:30Z

One more from a hand-run reproduction outside the automation, on plain Opus 5 with the standard context window:

req_011CdjUsSaGB6kUMVkidW2p6

The context variant makes no difference. Seven flagged requests carry Opus 5 (1M context) in the error text and the eighth carries plain Opus 5. The behaviour is identical, so this is not specific to the 1M path.

The exact prompt text is proprietary R&D and is not reproduced here, but every one of these requests is logged on your side and the request IDs point straight at it.

Reproduction

claude -p --model claude-opus-5 "<prompt>"

Paraphrase of the prompt's shape, with the proprietary specifics replaced (I have not verified that this paraphrase reproduces the flag - the request IDs above are the authoritative artifact):

Evaluate an engineering claim in two sentences. A shaped magnetic field is transmitted through a sealed steel pipe wall during the pre-contact clearance window, giving every particle size class the inward turning impulse needed to avoid contact with the outer wall without transferring the impact elsewhere. Checkable commitments: for every particle class, integrated inward magnetic impulse must exceed initial normal momentum with a design margin of 2; predicted and measured minimum wall clearance must be at least d95/2 at the former impact band. Does this justify retaining, revising, or withdrawing the claim?

Suspected cause

Speculation, offered only as a starting point. Taken individually, "shaped field", "transmitted through the sealed steel wall", "impulse must exceed initial normal momentum", "design margin" and "impact transfers elsewhere" are ordinary mechanics vocabulary. Taken together they may pattern-match to penetration or shaped-charge phrasing, even though the material being deflected is ore powder in a pipe and the goal is to stop wear on the elbow.

If that is what is happening, the classifier is keying on surface form rather than on subject matter, and any industrial-mechanics text that discusses directed force through a wall is exposed to the same failure.

A second-order effect worth noting

After reproducing the refusal in a Claude Code session, that same session began refusing subsequent tool calls with a safety check separate from auto mode blocked this request because of earlier conversation content. So investigating one of these flags inside Claude Code contaminates the session that is investigating it, and the natural next step - bisecting the prompt to find the trigger phrase - cannot be done from there. Diagnosing a false positive should not require a fresh session each time.

Environment

• Claude Code, non-interactive (claude -p) and via the Agent SDK
• Model: claude-opus-5, both the standard and the 1M context variants
• macOS

Related

#83934, #82933, #81375 report the same class of false positive for security and code-review work. This one is filed separately because the subject matter is industrial mechanical engineering with no adjacency to security at all, and because it comes with request IDs and a cross-variant observation.