[BUG] Fable 5 cyber safeguard blocks fire on Claude Code's own generated context, not user input (CVP-approved org)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

On a CVP-approved organization, Fable 5 sessions hit
API Error: Fable 5's safeguards flagged this message repeatedly.

The blocks do not land on anything I type. They land on context that Claude Code itself injects
— its own reply text, tool output, and subagent results.

For req_011CdzAQ2mkF2rsqh4XZAfnz (13 Aug 2026, 10:34 IST), everything added between my message
and the block was machine-generated:

| Time | Event |
|---|---|
| 10:32:45 | My message: "Resume development and resume interrupted the sub agents/tasks. Why was the task interrupted?" — answered normally |
| 10:33:25 | Fable 5 writes its own reply, mentioning "substrate chunks 1+2" |
| 10:33:27 | It runs git status, git log -3, gh run list --repo <repo> --limit 3 |
| 10:33:30–34 | Output returns. git status / git log carry nothing sensitive. The gh run list output lists the branch of each CI run, including claude/t-tier-substrate-1 |
| 10:34:06 | Blocked |

I typed nothing in that window.

Three distinct injection channels observed:

1. Tool output — gh run list prints the branch name of each CI run. My branches are named

after the test scenarios they implement (claude/sabotage-eval, claude/t-tier-substrate-1,
claude/chaos-kill-matrix).

1. Subagent results — req_011CdyM1NghQLYRaVRyWaxGH (00:17) fired immediately after a

subagent named "T-tier prerequisites design note" returned via task-notification.

1. Model re-switch — req_011Cdzy6PA4Qy1JhF8iyzZwW (20:51) fired right after

/model claude-fable-5, on the question "so is everything captured correctly?". Switching
back re-scans the whole accumulated session.

It is cumulative, and a compacted session cannot be recovered. The same git/gh commands
ran earlier in the same session with no block; blocks only began after hours of subagent results
had accumulated. Separately, in an earlier session the blocks began right after /compact — the
generated summary was ~22,800 characters and contained the scenario names (T1 ×9, sabotage ×3,
replay ×3). Because that summary is re-sent with every later request, even *"why have we hit a
block. please retry and resume."* was blocked. Compacting again regenerates an equivalent summary
from the same material, so the only escape is abandoning the session.

Context: this is a defensive AI-safety evaluation lab measuring whether policy gates, action
monitors, and human-approval steps catch a misbehaving agent. Everything runs locally against
synthetic fixtures — no real systems, networks, credentials, or user data, and nothing in the
prohibited categories. "Sabotage evaluation" is the standard term for this work; the branch and
commit names are already permanent in git history, and rewriting that history would destroy the
provenance of published research artifacts.

What Should Happen?

Since the organization is CVP-approved for exactly this use case, these requests should not be
blocked at all.

Failing that, three product behaviours would each independently prevent this:

1. Context that Claude Code generates itself — tool output, subagent results, compaction

summaries — should not be scored as if it were user intent. I never wrote the text that
triggered these blocks.

1. A compacted session should be recoverable. Right now, once flagged vocabulary enters the

compaction summary, every subsequent request carries it and there is no way out except
abandoning the session.

1. The CVP grant should apply inside Claude Code sessions, so an approved organization is not

blocked on the exact use case that was approved.

Error Messages/Logs

API Error: Fable 5's safeguards flagged this message (https://www.anthropic.com/legal/aup). Our
intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes
flag legitimate coding, cybersecurity, and biology tasks. Claude Code can't respond to this
message with Fable 5.

Try rephrasing the request in a new session or change your model.

Learn more: https://support.claude.com/en/articles/15363606

Request ID: req_011CdzAQ2mkF2rsqh4XZAfnz


**Request IDs**

13 Aug 2026: `req_011CdyM1NghQLYRaVRyWaxGH` (00:17) · `req_011CdzAQ2mkF2rsqh4XZAfnz` (10:34) ·
`req_011CdzQNtXFttnQF5H5C41gw` (13:37) · `req_011Cdzy6PA4Qy1JhF8iyzZwW` (20:51)

12 Aug 2026, post-`/compact`: `req_011CdxJQ3seZRS2x49Y7kiax` · `req_011CdxNDMePZ5esSowej1LGW` ·
`req_011CdxViAJPS8KDLoVNDBj75`

Steps to Reproduce

1. In a git repository, create branches and commits whose names describe adversarial test

scenarios. Mine include:

```
git branch claude/sabotage-eval
git branch claude/t-tier-substrate-1
git branch claude/chaos-kill-matrix

git commit -m "feat: build the three-condition sabotage runner"
git commit -m "wip: add T4's attack variants and its split-call covert proposer"
git commit -m "results: publish the 23-scenario chaos kill matrix"
```

Push them so CI runs are associated with those branch names.

1. Start a Claude Code session on Fable 5 and work normally for several hours — delegate to

subagents with task descriptions naming the scenarios (e.g. *"T-tier prerequisites design
note"*), and let their results return.

1. Ask an ordinary question such as "Resume development. Why was the task interrupted?"

1. Let Claude run routine repository checks on its own:

``
git status
git log -3
gh run list --repo <your-repo> --limit 3
``

The gh run list output prints the branch each CI run belongs to, injecting the branch names
into the conversation.

1. The next assistant turn is blocked with the cyber-safeguard API error — without the user having

typed anything sensitive.

Note on timing: this is cumulative. Early in a session the same commands pass without issue.
The block appears only once enough scenario vocabulary has accumulated in context, which is why it
looks intermittent.

Variant (compaction path): run /compact on such a session. The summary retains the scenario
names and is re-sent with every later request, so even a message like "please retry and resume"
is blocked, and the session cannot be recovered.

Claude Model

Fable 5 (claude-fable-5) as the planner. Opus 5 (claude-opus-5) subagents — never blocked,
on the same files, branch names, and scenarios. Switching the planner to Opus 5 resumed work
immediately.

Is this a regression?

No, this never worked

Last Working Version

N/A

Claude Code Version

Claude 1.30096.0 (9460ab) 2026-08-13T05:35:59.000Z

Platform

Claude subscription (claude.ai account / Anthropic first-party) — not Bedrock or Vertex.

Operating System

Windows

Terminal/Shell

Other

Additional Information

Control that isolates it to Fable 5: Opus 5 subagents read and write the same files, branch
names, and test scenarios all day and were never blocked once. Switching the planner to Opus 5 at
10:34 resumed work immediately with no further issue.

Config note: I have switchModelsOnFlag: false, which is why these surface as hard API Error
stops rather than a silent switch to Opus 4.8. That setting changes how a block presents, not
whether the flag fires.

Possibly related: #84352 — CVP-approved organization still receiving cyber-safeguard blocks.

Also reported through the CVP false-positive form. Approval reference and organization ID
available privately to maintainers on request.