Fable 5 safeguard false positive: [cyber] flag on session editing its own permission hooks (req_011CffmtDtTRX4NrwePWGLfh)

What happened

Mid-session, a response attempt was dropped with:

API Error: Fable 5's safeguards flagged this message (https://www.anthropic.com/legal/aup). Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate coding, cybersecurity, and biology tasks. Claude Code can't respond to this message with Fable 5. Details: [cyber] Request ID: req_011CffmtDtTRX4NrwePWGLfh

What the session was actually doing

Plain systems-engineering work, nothing security-related:

1. Reviewing a ~20-line C diff in a text-generation research program (replacing a log()-based ranking comparator with integer cross-multiplication for cross-platform determinism).
2. Narrowing a regex in the user's own local PreToolUse permission hook (a gate that blocks pip install and unapproved training launches), with red/green probe runs of that hook.

Why it probably fired

The transcript necessarily quotes the permission hook's own stderr (BLOCKED: ... messages), regex patterns that gate shell commands, and terminal chrome like "bypass permissions on". That vocabulary pattern-matches [cyber] even though the content is the user's own permission tooling — the exact thing Claude Code hooks are documented to do.

This is recurring: the same project (a byte-level statistical text organism, pure C + shell hooks) has been flagged several times across sessions.

Impact

One in-flight response lost; the session itself survived and continued after retry. The main cost is trust and flow: long multi-hour working sessions get interrupted by false positives on their own permission-hook output.

Ask

Teach the safeguard layer to tolerate quoted PreToolUse/PostToolUse hook stderr and permission-gate regex text appearing in context — it is first-party Claude Code functionality, not an attack surface.

Environment: Claude Code v2.1.283→2.1.288, macOS (Darwin 25.4.0), model Fable 5. Timestamp: 2026-10-03 ~21:40 Asia/Jerusalem.