[cyber] safeguard false-positives on routine wallet/blockchain development — including on harness-generated <task-notification> blocks

Environment

• Claude Code 2.1.241
• macOS (Darwin 25.5.0), zsh
• Model selected: Fable 5

Summary

The [cyber] safeguard classifier fired six times in six days (2026-08-19 → 2026-08-24) on a
single private repository doing routine work: automated withdrawal testing of a crypto-wallet
backend against a testnet/staging environment, TOTP/2FA handling for my own account, and Chrome
DevTools automation against my own staging app. No offensive security, no third-party targets, no
mainnet funds. Every flag switched the session off the model I had selected.

Examples of flagged messages

Paraphrased from my transcripts:

• A request to run test scenario 3 carefully, one step at a time.
• A request to pick the test scenarios back up and work through them individually.
• A report that my wallets were not displaying, with a screenshot of my own staging UI attached.
• A request to reuse my own Chrome profile so the agent could complete a 2FA prompt on my own

account.

None of these describe an attack. The common thread is domain vocabulary — wallet, signer, key,
Vault, token, 2FA — not intent.

Separate defect: it flags harness-generated blocks

One of the six flags (2026-08-20 17:39:03Z) fired on a background <task-notification> block — a
tool-completion notification generated by Claude Code itself, not anything I typed. Whatever text is
being classified, harness plumbing should be excluded from it.

Impact

For anyone building a crypto or payments product, Fable 5 is unusable in practice: six flags in six
days, each one silently moving the session to Opus 4.8 for hours (see the companion issue on the
switch being permanent).

Ask

• Weight intent over domain vocabulary for first-party development work.
• Exclude harness-generated message blocks (<task-notification>, tool results, command stdout)

from classification.

• Put a "this was a false positive" action on the notice itself. Today the only route is

/feedback, which uploads the whole session — not something everyone can do from a work
repository, which means the false-positive rate you see is undercounted.