[Bug] Claude Fable 5 safeguards false positive on defensive security code review in private repositories

Bug Description
False positive: Fable 5 safeguards flagged routine defensive-security work on my own codebase

Four times in one session, Fable 5's safeguards flagged my message and the system
fell back to Opus 4.8. Every one of those messages was a request to review or fix
my own code, in my own private repository, on infrastructure my company owns.

Session: aa06272d-2852-4c62-a77e-c2d93a275023

2026-08-08T04:02:04Z req_011Cdpce4FBTNE2CoAJ1E8Bb
"przegladnij zastosowane poprawki ale nie marnuj tokenow sprawdz tylko
czy poprawki sa prawidlowe."
("review the applied fixes, don't waste tokens, just check whether the
fixes are correct")

2026-08-08T04:15:11Z req_011CdpdeaMnVqF4hJSwQfpvP
"teraz ty sprawdz ale jako fable a nie opus!! nie zmieniaj modelu na opus!!"
("now you check it, but as Fable and not Opus!! don't switch the model
to Opus!!")

2026-08-08T11:27:41Z req_011CdqCcHQMCBybGqmyaVxrZ
"przelec kod czy na pewno jest wszystko ok, nie marnuj tokenow zrob to madrze."
("run through the code, check everything is really fine, don't waste
tokens, do it wisely")

2026-08-08T11:58:02Z req_011CdqEwdGCyjkrJ8hXk94pu
"Chyba madrym by bylo naprawic te rzeczy teraz co ?"
("it would probably be wise to fix these things now, right?")

All four: claude-fable-5 -> claude-opus-4-8, subtype model_refusal_fallback.

WHAT I WAS ACTUALLY DOING

Building and hardening "mflared", a self-hosted Cloudflare Tunnel replacement my
company runs on its own Hetzner server. In this session I was fixing defects a
code review had found in a read-only admin dashboard I had just written:

• an encoded path traversal in a static file mount (fs.Sub + StripPrefix)
• a DNS-rebinding hole on a loopback listener (Host header allow-list)
• a systemd unit running with more privilege than it needed
• a data-join bug that misreported which tunnels were live

Private repo, my own infrastructure, entirely defensive. No third-party systems
are involved anywhere in this work.

WHY I THINK IT MISFIRED

The flag appears to track vocabulary rather than intent. Fixing a traversal bug
and exploiting one use the same words — "traversal", "rebinding", "leaked
credentials", "exploit path" — and a request as plain as "check whether the fixes
are correct" was flagged in a context that had been unambiguous for hours.

Note the second one especially: I had explicitly asked to STAY on Fable 5, and
that very message was flagged and routed away. That is a bad experience — the
user's stated preference is silently overridden by a false positive.

WHAT I'D ASK FOR

1. Weight conversational and repository context. This session had a long,

unambiguous history: my own private repo, my own servers, fixing my own bugs.

1. Don't let a false positive silently override an explicit model choice, or at

least make the reason legible in the moment rather than only in the transcript.

1. Defensive security work on one's own systems is a mainstream use of Claude

Code. Right now it appears to be one of the easiest ways to trip this.

I did not lose work — the fallback did its job and the session continued. The
problem is that routine security hardening on my own code reads to the classifier
as something to be routed away from, four times in one day.

Environment Info

• Platform: darwin
• Terminal: xterm-256color
• Version: 2.1.224
• Feedback ID: 790b580a-c204-4508-964a-f8bea8d62a09

Errors

[]