[Bug] Anthropic API Error: Dual-use safeguard false positive on benign git commands in security-focused sessions

Bug Description
False positive: dual-use safeguard flagged benign repo work on Fable 5.

Context: solo developer hardening my own open-source project (a git +
Claude Code hook toolkit) before publishing it. Local repo, no external
targets. The session involved writing a SECURITY.md threat model, a static
"no network primitives" tripwire, and tests for fail-open behaviour —
ordinary pre-publication due diligence on my own code.

The flag fired on this tool call:

git show HEAD~1:CONTEXT.md | wc -l; wc -l < CONTEXT.md

A line-count comparison of a markdown file, run while writing a handoff
note. Nothing security-related in the command itself.

It then fired a second time on the assistant message that was explaining
the first false positive.

The trigger appears to be accumulated session vocabulary (threat model,
malicious PR, ReDoS, penetration testing) rather than the content of the
flagged message. Effect: repeated fallback from Fable 5 to Opus 4.8 during
defensive security work on my own repository.

Environment Info

• Platform: darwin
• Terminal: antigravity
• Version: 2.1.226
• Feedback ID: fdc143c3-f923-4a45-91cc-cc0d5c2e2031

Errors

[]