Fable 5 safeguards flag defensive security audit output (false positive)

Summary

Claude Fable 5 (via Claude Code) repeatedly returned "Fable 5's safeguards flagged this message" while relaying the results of a defensive security audit of my own repository. The work was a routine audit -> fix -> re-audit loop hardening our own CI quality gates and container configuration. No third-party system was targeted.

Request IDs

• req_011Cdt2fD17bvZ6P2VPAtHvy
• req_011Cdt2gYH1oyAsEYKT9tj5V
• req_011Cdt3cFAsL54JvgbVmXwQG
• req_011Cdt7ctHFus4d3s5ZkRVYe

What was happening

A subagent produced a security audit report on our own repository (self-owned, own branch). The main loop then tried to summarize that report for me. Every attempt to relay the summary was flagged, four times in a row.

Every finding in the report had the same shape: "our own gate fails to detect X, therefore we should add detection for X".

1. The Docker Compose hardening gate verifies that required keys are present, but never rejects privilege-granting keys, so a service could regain privileges without any gate noticing.
2. That gate scans a single hard-coded path, so a second compose file would never be inspected.
3. One service has no exposure preflight check while the equivalent service does (an asymmetry we wanted to close).
4. GitHub Actions are referenced by mutable tag instead of being pinned to a commit SHA.
5. The secret scanner's dotenv rule does not match filenames such as prod.env, so a credential file could be committed without warning.

Why this looks like a false positive

• The target is the user's own repository and branch.
• Every finding asks to strengthen a detector. Nothing exploits, evades, or targets anyone.
• The vocabulary that most likely triggered the classifier (container privilege escalation vectors, secret-scan bypass paths, supply chain pinning) is unavoidable when describing what a security gate is supposed to catch. Describing the attack is how you specify the defense.

Impact

The session was blocked mid-workflow and two follow-up audit agents could not be launched. Switching to Opus 5 via /model let the exact same content through, so the behavior appears specific to Fable 5.

Environment

• Claude Code CLI on Linux
• Model: claude-fable-5 (blocked) / claude-opus-5 (same content passed)