[Bug] Safeguard false positive on /compact makes the session unusable — following ordinary messages are flagged too
Environment
- Claude Code 2.1.280, Claude desktop app 2.9939.4, macOS 27.0, Opus 5.5
Describe the bug
A safeguard false positive on /compact leaves the session in a state the user cannot get out of:
/compact <instructions>fails with
API Error: Opus 5.5's safeguards flagged this message (https://www.anthropic.com/legal/aup). This sometimes happens with safe, normal conversations. …
The conversation itself is unaffected — compaction simply does not happen.
- After that, ordinary messages in the same session get flagged as well. In one session, the two follow-up messages the user typed (plain prose, no code, asking the assistant to reword the compaction instructions) each failed with the same error. At that point the session can no longer be used at all — neither compacted nor talked to.
This is worse than the general false-positive problem already reported in #98000, #97817, #96703, #96014 and #95459, because compaction is exactly the operation you reach for when a session is long, and the failure removes the remaining escape route. The only workaround we found is to abandon the session and hand off to a fresh one.
Why compaction is especially exposed
Compaction sends the entire conversation for summarisation, so it has the largest possible surface for a classifier to trip on, while the user has no way to see which span was flagged, and therefore no way to exclude or rephrase it. Rewording the instruction argument does not help, since the flag is not attributable to that argument.
Observed frequency
Across our transcripts the error appears in bursts — e.g. 10 occurrences on one day, 2 on another, within a handful of sessions; long sessions with a lot of quoted tool output seem more prone to it. Content is routine engineering work (shell output, git operations, documentation).
What would help
- Do not let a flagged compaction poison the rest of the session — after a flagged request, ordinary turns should still work.
- Surface what was flagged (even an offset or the offending span) so users can exclude it.
- A documented fallback: if summarisation is refused, fall back to a local/truncating strategy rather than leaving the user with a session that can neither compact nor continue.