[Bug] Anthropic API Error: Opus 5 Safeguards False Positive on Defensive Security Code

Bug Description
False positive: Opus 5 safeguards flagged legitimate defensive security work and
switched me to Opus 4.8.

Context: fixing an authenticated path-traversal vulnerability in our own codebase. The work was standard AppSec — reproducing the issue with curl against a local dev stack, adding input validation (ULID path params), a traversal guard in the HTTP client, and removing a dead internal endpoint that leaked OAuth tokens. All of it defensive, on our own repo, on our own machine.

The flag triggered mid-task on this security/cybersecurity content. Nothing
offensive or targeting third parties. The broad safeguard is over-flagging
legitimate security engineering.

Environment Info

• Platform: darwin
• Terminal: ghostty
• Version: 2.1.226
• Feedback ID: f82864f6-8c53-40ac-9ba0-cc27b7862977

Errors

[]