[Bug] Anthropic API [cyber] safeguard false positives on non-malicious messages in security project context

Bug Description
False positive: [cyber] safeguard flag on a trivial message.

Typing just a greeting ("안녕하세요") in Claude Code triggered the [cyber]
safeguard and auto-downgraded Opus 5 (1M context) to Opus 4.8. The message
itself is harmless — the classifier is reacting to the project context
(CLAUDE.md + agent/skill descriptions), not the message.

This is an AUTHORIZED, DEFENSIVE security-automation project: SOC malware
analysis (MALAX) and a consented red-team lab bound to local loopback
(127.0.0.1:8787). No real-world targets, no unauthorized activity.

Nearly every turn — even greetings and non-security chit-chat — gets flagged
and downgraded, which is disruptive. Please reduce false positives for
legitimate authorized/defensive security engineering contexts, or scope the
[cyber] classifier to the actual message rather than ambient project context.

Environment Info

• Platform: win32
• Terminal: Orca
• Version: 2.1.237
• Feedback ID: 7023cbb6-55e9-46ba-abb0-41ae99f7fa91

Errors

[]