[BUG] Fable 5 [cyber] safeguard becomes session-sticky and blocks unrelated prompts, /feedback, and /doctor

Preflight Checklist

• [x] I have searched existing issues. There are related safeguard/context-contamination reports, but this issue adds a particularly clean same-session reproduction: after one [cyber] false positive, the session later blocked benign research review, attempts to report/debug the false positive, the literal question What is the capital of Texas, and finally Claude Code's own /doctor command.
• [x] This is a single bug report: a false-positive safeguard state persists across unrelated subsequent turns and prevents normal in-session diagnosis/recovery.
• [x] The affected session was running Claude Code 2.1.251. 2.1.252 was published only minutes before the final /doctor reproduction and had not been installed/restarted in this session; I am not claiming reproduction on 2.1.252. The exact server-side request IDs are included below.

What's Wrong?

A Claude Code CLI session running Fable 5, high effort encountered a [cyber] safeguard false positive during benign commercial API-provider market research. The work was comparing third-party AI API relay providers, pricing, model availability, routing terms, reliability, and economics. The session was acting as the buyer/customer and using ordinary browser/account workflows on accounts I controlled.

The first false positive is frustrating, but the more serious bug is what happened afterward: the session appears to enter a sticky safeguard state in which the current prompt no longer meaningfully controls classification. Subsequent requests were hard-blocked as [cyber] even when the immediate prompt contained no cybersecurity task at all.

The cleanest examples are:

What is the capital of Texas

and later:

/doctor

Both were blocked with the same Fable 5 [cyber] safeguard error.

The /doctor result is especially problematic. After the false positive made the session unusable, I tried Claude Code's own standard diagnostic command. The safeguard blocked that too. A user can therefore enter a safeguard failure state and then be prevented from invoking the product's normal troubleshooting path for that failure.

I also submitted Claude Code's /feedback flow separately for all eight request IDs below. Each false-positive event therefore has an individual feedback report tied to its request ID in addition to this consolidated/master issue. The request IDs should provide Anthropic with durable correlation keys even if those feedback reports are not publicly visible as normal GitHub issues.

Exact event sequence / request IDs

All events occurred in the same Claude Code session on 2026-08-31.

| Approx. local time | Immediate task/prompt | Request ID |
|---|---|---|
| 1:05 PM | Benign provider pricing/account research using ordinary browser automation | req_011CebGZ1yTKmHWekhfoHpZt |
| 2:03 PM | Main Fable session reviewing completed Opus subagent research deliverables | req_011CebLzDgaL8hwThfrXEf1h |
| 2:32 PM | Please continue the review gate on the subagents RESEARCH work... | req_011CebPDVfMLkAWB5ysB7sGR |
| 2:34 PM | Please review the subagents LEGAL RESEARCH work for contract coverage | req_011CebPLqUfJ71BLp6NrDXyV |
| 2:34 PM | Attempt to submit feedback about the benign safeguard block | req_011CebPPPXXx1UyyNCwz3sbm |
| 2:36 PM | Explain: req_011CebPLqUfJ71BLp6NrDXyV | req_011CebPUCvT1q9va9BvT7gZg |
| 2:36 PM | What is the capital of Texas | req_011CebPW8we6AjrAcSEaLTUS |
| 2:54 PM | /doctor | req_011CebQu4M52fSUvzd2pQj2y |

There was roughly an hour between the first and second blocks while an Opus subagent independently completed delegated research. The affected state therefore persisted across time and task boundaries inside the same conversation.

What Should Happen?

1. A subsequent unrelated benign prompt should be evaluated on its current task rather than inheriting a permanent hard-block state from an earlier false positive.
2. A trivial factual question such as What is the capital of Texas should not be classified as [cyber] because of stale conversation context.
3. Requests asking to understand or report a false positive should remain usable.
4. /doctor should remain available as an out-of-band diagnostic/recovery path even when a model safeguard has fired. If /doctor depends on a model turn that can be blocked by the same failure being diagnosed, it cannot reliably diagnose safeguard-related failures.
5. If the intended architecture re-scores the entire accumulated context and an affected session cannot recover, the CLI should state that clearly and provide a deterministic recovery/new-session path instead of repeatedly suggesting rephrasing.

Error Messages/Logs

Representative safeguard response:

API Error: Fable 5's safeguards flagged this message (https://www.anthropic.com/legal/aup). Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate coding, cybersecurity, and biology tasks. Claude Code can't respond to this message with Fable 5.

Double press esc to edit your last message, or try a different model with /model.

Send feedback with /feedback or learn more: https://support.claude.com/en/articles/15363606

Details: `[cyber]`

Request ID: req_011CebPW8we6AjrAcSEaLTUS

That request ID corresponds to the entire immediate prompt:

What is the capital of Texas

Later, Claude Code's own diagnostic command was blocked the same way:

> /doctor

API Error: Fable 5's safeguards flagged this message (...)
Details: `[cyber]`
Request ID: req_011CebQu4M52fSUvzd2pQj2y

Steps to Reproduce

The important reproduction is the post-flag session state, not necessarily the exact initial false-positive trigger.

1. Start Claude Code CLI with Fable 5 selected.
2. Work in a normal long-running coding/research session until a benign request is falsely classified as [cyber]. In the observed session this happened during commercial API-provider pricing/economics research; no offensive-security task was being performed.
3. Remain in the same session.
4. Send a benign task such as:

``text
Please review the subagent's research work for contract coverage
``

1. Observe the same [cyber] block.
2. Send the completely unrelated prompt:

``text
What is the capital of Texas
``

1. Observe the same [cyber] block again.
2. Run:

``text
/doctor
``

1. Observe that /doctor itself is also blocked with [cyber].

Anthropic can inspect the eight request IDs above to trace the exact server-side sequence even if the initial false-positive trigger is probabilistic.

The particularly useful deterministic part of the reproduction is that once the affected session state existed, even unrelated trivia and the product's own diagnostic command were rejected with the same category.

Claude Model

Fable 5, high effort

Is this a regression?

I don't know

Last Working Version

Unknown. I have seen a similar sticky safeguard failure in another long-running AI coding session before, but I do not have a known-good Claude Code version that reliably excludes this behavior.

Claude Code Version

2.1.251 terminal CLI (not the VS Code extension)

Platform

Anthropic API

Operating System

Windows 10 x64

Terminal/Shell

PowerShell (pwsh)

Additional Information

Why /doctor is a particularly strong reproduction

Claude Code issue/support workflows commonly ask users to run /doctor when diagnosing CLI problems. In this case I did exactly that after collecting the safeguard request IDs, and the safeguard prevented the command from running.

That creates a circular failure mode:

safeguard false positive -> session becomes unusable -> user invokes the product's standard diagnostic command -> same safeguard blocks the diagnostic command

Even if an individual model-layer false positive is expected to occasionally occur, the CLI should not allow that state to disable its own diagnostics/recovery UX.

Individual /feedback reports already submitted

I submitted /feedback once for each of these eight blocked requests before filing this master report:

• req_011CebGZ1yTKmHWekhfoHpZt
• req_011CebLzDgaL8hwThfrXEf1h
• req_011CebPDVfMLkAWB5ysB7sGR
• req_011CebPLqUfJ71BLp6NrDXyV
• req_011CebPPPXXx1UyyNCwz3sbm
• req_011CebPUCvT1q9va9BvT7gZg
• req_011CebPW8we6AjrAcSEaLTUS
• req_011CebQu4M52fSUvzd2pQj2y

This issue is the consolidated reproduction tying those events together as one session-persistence/recovery failure.

Related issue class

There are existing reports around safeguard false positives, accumulated-context contamination, and inability to recover the selected model after a safeguard event. This report's distinguishing evidence is the same-session sequence ending with two unusually clean current-turn controls:

1. What is the capital of Texas -> [cyber]
2. /doctor -> [cyber]

The second makes this specifically a Claude Code recovery/diagnostic bug even if the underlying safeguard classifier is server-side.

Authorship note: Drafted by ChatGPT (GPT-5.6 Sol) from the user's Claude Code transcript at the user's explicit request. The request IDs, environment, prompts, and observed behavior come from that transcript.