Four consecutive [cyber] safeguard flags destroyed a working session tonight.
Bug Description
Four consecutive [cyber] safeguard flags in ~20 minutes killed my working
session tonight. And when I ran /bug to report it, the form pre-filled with
a STALE error from September 21 (the EINVAL readlink below) and an old
version string — because safeguard refusals are never written to the error
log that /bug reads. So the safeguard destroys the session AND is invisible
to your own bug-report pipeline. That's two bugs.
What was flagged, four times: a 20-line C diff (replacing log() with integer
cross-multiplication in a text-generation research program), parity probe
output, and the stderr of my own Claude Code PreToolUse permission hooks
("BLOCKED: ...") — text your own product printed into the transcript.
Zero security content. Recurring for weeks on the same pure-C research repo.
Cost tonight: abandoned a multi-hour session mid-task, terminated a paid
RunPod A40 carrying a half-finished preregistered experiment, killed a second
model session, cold-started a new session without the working context.
I pay for Max and I lose paid GPU hours to YOUR false positives.
Full picture in issue #99295 (filed tonight from the session itself, with an
escalation comment).
Environment Info
- Platform: darwin (macOS, Darwin 25.4.0)
- Version: 2.1.283 → 2.1.288 (self-updated mid-session)
- Model: Fable 5
- Request ID (one of the four flags): req_011CffmtDtTRX4NrwePWGLfh
- Feedback ID: 423f6eed-993b-46eb-ad87-aa5f7588f87b
- Time: 2026-10-03 21:30–21:50 Asia/Jerusalem
Errors
The four [cyber] refusals are NOT in the log below — that is the point.
The prefilled EINVAL readlink from 2026-09-21 is unrelated. Pull the session
by the Request ID above and see what your classifier called a cyberattack.
Ask
- Stop flagging quoted PreToolUse hook stderr and permission-gate regexes —
first-party Claude Code output.
- A flag must not burn the turn: give a retry path that keeps the session.
- Write safeguard refusals into the error log so /bug can actually report them.