[Bug] Fable 5 safeguards chain-flag entire sessions: children's song lyrics and routine Korean e-commerce instructions all flagged (6 request IDs)

Environment

• Claude Code version: 2.1.220
• OS: macOS 15.7.5 (darwin)
• Model: claude-fable-5 (paid subscription)
• Locale: Korean (all work instructions are in Korean)
• switchModelsOnFlag: false is set

Summary

Once a session's context gets classified as cybersecurity-adjacent, every subsequent user message is flagged by Fable 5's safeguards, regardless of content — including literal children's song lyrics, casual greetings, and routine e-commerce development instructions. The session becomes permanently unusable with Fable 5. This has been recurring since at least 2026-09-15 across multiple sessions and has cost several working days.

Flagged messages (verbatim examples, all flagged)

• "뭐여 왜 고장났어" ("huh, why is it broken") — casual remark, flagged. Request ID: req_011Cf4ep7JmShNCunQNcMTCA
• "어이 모시모시" ("hey, hello") — greeting, flagged. Request ID: req_011Cf4eqdhPw7qpWJgBevxfZ
• "산토끼 토끼야 어디로 가느냐" — lyrics of a Korean children's song about a mountain rabbit, flagged. Request ID: req_011Cf4esqMBZR3KifC7K94jX
• "추가 사항은 언급하지 말고 정확하게 기획자가 물어본것에만 답하는것으로 다시 코멘트 구성해서 출력" ("rewrite the comment to answer only what the planner asked") — routine documentation instruction, flagged three times in a row with minor rewording. Request IDs: req_011Cf4eHWzBnAdbDqBjmL7gM, req_011Cf4eKifDJUVfLKzxfdAWm, req_011Cf4eMsmx1xZZa31Y1x1Uh
• "이제 네가 확인한 인수인계 문서와 설계서에서 공급사 지역별 배송비 페이지가 제대로 보이지 않아서 보류되었던 모든 항목을 확인해" ("verify all items that were on hold because the supplier regional shipping fee page wasn't displaying") — e-commerce admin work instruction, flagged (2026-09-19).

None of these messages contain security content. The flags chain: after the first flag in a session, essentially every message is flagged.

Suspected mechanism

Per the support article (15363606), safeguard checks "review everything the model reads, not just your latest message — including memory, content from connectors, web search results, and files."

Our project is a large Korean e-commerce platform. The repository's project instructions (.claude/rules/) include a defensive security review checklist (OWASP-style: SQL injection detection patterns with example payloads such as pg_sleep, XSS filter-bypass examples, WAF regexes) that is auto-loaded into every session's context by design, for code-review purposes. Combined with legitimate admin-panel browser automation for QA (logging into our own test malls), the resident context appears to trip the cybersecurity classifier — after which no user message can pass, no matter how innocuous.

This matches #85041 (vocabulary matching over intent) and #83939 (trivial prompts flagged), but adds two data points not covered there:

1. Chained flagging: the unit of false positive is the session context, not the message. "Edit prompt and retry" is useless advice when a nursery rhyme gets flagged.
2. Non-English users: all flagged instructions are ordinary Korean business language.

Impact

• Multiple working days lost between 2026-09-15 and 2026-09-19 on a paid plan.
• With switchModelsOnFlag: false: the session pauses on nearly every message.
• With the default (auto-switch): work silently degrades to Opus 4.8 mid-task.
• Repeatedly abandoning sessions and re-handing-over context to fresh sessions is the only workaround found, and it does not last.

Requests

1. Evaluate flags against the current message intent, not only accumulated context; or decay/reset the classification instead of chain-flagging entire sessions.
2. Whitelist or down-weight defensive security checklist/documentation content in project instruction files — this is standard practice in enterprise repos (secure-coding rules are exactly the files teams load into review context).
3. Document what was flagged (category at minimum) so users can act, instead of guessing.
4. Review the attached Request IDs as false-positive samples.