[MODEL] Cyber safeguard false-positives on closed-source release engineering: Fable 5.1 silently rerouted to Opus 4.8, and one flag contaminates the session

Summary

I am a Claude Max user with Fable 5.1 selected in Claude Code. On 2026-09-12 the cyber safeguard flagged my session repeatedly and silently rerouted it to Opus 4.8. The flag fired on ordinary benign messages, and once on the tool output of reading my own local project markdown. Re-selecting Fable 5.1 with /model fable did not help; the next message rerouted again, consistent with one flag contaminating the whole session.

Turning off "Switch models when a message is flagged" stops the silent downgrade, but then a flagged message halts the conversation outright. So the two available configurations are a silent downgrade to Opus 4.8, or a hard stop. There is no configuration in which this work proceeds on Fable 5.1.

This is the same failure mode as #63751, which has been open since 2026-05-29. I am adding a second, concrete, well-instrumented case.

Type of behavior issue

Claude refused a reasonable request / behavior changed between sessions (model silently swapped mid-turn).

What I am working on

I build a closed-source game engine. The task is a partner distribution kit: a prebuilt single-file playable HTML shipped to trusted partners, plus a build script that lets them rebuild it from their own scripts and assets without receiving engine source.

The engineering steps are:

• Compile my engine to WebAssembly and strip debug names, source maps, and .debug_* sections from my own binary.
• Rename my own internal JS/Wasm interface identifiers so the shipped artifact does not expose engine internals.
• Minify and bundle the runtime JavaScript with standard TypeScript, Rollup, and Terser.
• Strip diagnostic and log strings from my own release build.
• Run a build-time check asserting that none of my engine's source paths, symbol names, or internal identifiers reach the archive before it is written.

This is routine closed-source release engineering that every commercial SDK vendor does. Every line of code involved is mine. There is no third-party target, no exploit, no malware, no attack tooling, and no vulnerability research against anyone else's software.

Why this does not match the documented trigger categories

The support article "Why Claude switched models in your conversation with Fable 5" lists four categories. None applies:

1. Offensive cybersecurity (exploits, malware, attack tooling). No. I am hardening distribution of my own product. This is defensive IP protection, the opposite of an attack.
2. Dual-use biology. Not applicable.
3. Distillation attacks. Not applicable.
4. Frontier LLM development. Not applicable.

The classifier appears to key on surface vocabulary shared between legitimate release engineering and malware evasion: "obfuscate", "strip symbols", "leak", "protect", "no readable strings". In context every one of these refers to my own build artifacts. Penalizing this vocabulary blocks precisely the defensive work a safety system should permit.

What happened

All times Pacific, 2026-09-12.

1. I loaded my project's workstream context into a Claude Code session. Shortly after: "Fable 5.1's safeguards flagged this message. Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate coding." Session rerouted to Opus 4.8.
2. I asked a purely informational question, "What is the issue here?". Answered by Opus 4.8.
3. I ran /model fable to re-select Fable 5.1, then asked what steps remained on the partner SDK work. The turn began on Fable 5.1. When the assistant read my own local markdown step ledger, the session rerouted to Opus 4.8 mid-turn. The trigger was tool output from reading my own documentation, not anything I typed.
4. Every subsequent message, including a plain request to research this problem, continued on Opus 4.8. Re-selecting Fable 5.1 did not restore it. This matches the session-contamination behavior in #63751.
5. I applied the documented mitigation and turned off "Switch models when a message is flagged." The session now stays on Fable 5.1, but a flagged message is blocked outright and the conversation cannot continue.

Expected behavior

Stripping symbols, minifying, renaming identifiers, removing log strings, and leak-checking my own build output should not trip the offensive-cyber safeguard. The session should stay on Fable 5.1.

Impact

• The reroute fires on my own local files being read, so any session touching this project's workstream context is affected.
• This is a multi-week, actively reviewed effort with 36 tracked implementation steps. Losing the selected model is a material loss of capability and of paid value.

Requests

1. Tune the classifier for release-engineering vocabulary. Symbol stripping, minification, identifier renaming, log stripping, and leak-checking of one's own build output are defensive packaging tasks.
2. Stop one flag from contaminating a whole session. Re-selecting the model should restore it. See #63751.
3. Give a flagged-but-legitimate request a path forward. With the switch off, a flag is a dead stop with no way to assert the work is legitimate and continue. An in-conversation override, or an account-level trust setting for verified use cases, would resolve this without weakening the safeguard for anyone else.

Can you reproduce this?

Yes, consistently, on any session that loads this project's documentation.

Environment

• Claude Code version: 2.1.269
• Platform: Anthropic API, Claude Code CLI
• OS: macOS 26.2 (Darwin 25.2.0)
• Plan: Claude Max
• Selected model: Fable 5.1 (claude-fable-5-1), effort xhigh
• Rerouted to: Opus 4.8
• Permission mode: Accept Edits ON
• Account email withheld from this public issue; happy to provide it privately for account-level review.

Related

• #63751 — same class of false positive and the same session-contamination behavior, open since 2026-05-29.