Fable 5 [cyber] safeguard false-positives make the model unusable for telecom/VoIP development
Summary
Fable 5 is effectively unusable for coding on my project: its safety classifier repeatedly flags legitimate software-engineering sessions with Details: [cyber] and force-switches the session to Opus 4.8 mid-task. This has happened consistently — I have never managed to complete a coding task on Fable 5 in this codebase.
Context
I work at a Brazilian telecom operator (MVNO). The codebase is ordinary telecom backend work: SIP trunk configuration, voice/call APIs, DID number provisioning, WhatsApp Business onboarding, webhook handling. Nothing offensive-security related.
The most recent flag happened in the middle of building a large feature (a voice/call API, "Fase 0: SIP tests"). The session involved normal domain vocabulary — SIP, UDP, API tokens, credential configuration, sandbox network restrictions — and the safeguard fired mid-conversation:
"As proteções de Fable 5 sinalizaram esta mensagem... Alternado para Opus 4.8. Detalhes: [cyber]"
The problem
- Neither I nor Claude itself can tell what triggered it. The only detail exposed is the string
[cyber]. When I asked Claude (Fable 5, in a new session) why the previous thread was flagged, the best it could do was informed guessing: telephony vocabulary (SIP/UDP/tokens/credentials) probably pattern-matches credential-harvesting or network-tooling classifiers. - It's a hard mid-task interruption. The model switch lands in the middle of multi-step orchestration (worktrees, task lists, spawned subagents), which is exactly when you least want the model swapped underneath you.
- For a telecom domain this is not an edge case. Every meaningful session in this codebase touches SIP, tokens, and network configuration. If that reliably trips the classifier, Fable 5 is simply not usable for an entire industry vertical of legitimate work.
What would help
- Expose what in the message tripped the classifier (even a rough category or the offending span), so users can rephrase or restructure.
- An in-product way to say "this is a false positive, keep me on Fable" — an appeal/override for authenticated users on their own private repos.
- Better calibration for telecom/VoIP vocabulary: SIP + UDP + token/credential configuration is the daily bread of a large legitimate industry.
Environment
- Claude Code desktop app on Windows 11
- Model: Fable 5 (claude-fable-5), auto-switched to Opus 4.8
- Flag detail shown:
[cyber]