On 30 September Claude Code was working through the security roadmap for Wegweiser, the product I build for managed service providers. It had just read the imports of the login and multi-factor routes and written a configuration file for gitleaks: twenty-five lines, mostly comments, telling a secrets scanner which files in the history hold library constants and dummy data. It was my own repository, on a task I had written down myself. Then this:

Fable 5.1's safeguards flagged this message. Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate coding and cybersecurity tasks. Switched to Opus 4.8.

Details: [cyber]

This morning it happened again.

Who is asking

I run Old Forge Technologies on my own, from Kennett in Suffolk. Most of my work involves somebody trusting me with their systems, which is why the business is Cyber Essentials certified and why I go looking for holes in my own code before anybody else can. Of everything Claude does for me, checking my code for bugs that could hurt a customer is the job I most want it to do well.

On 13 July I applied to Anthropic's Cyber Verification Program, which exists for people in my position. It asks what you intend to do and checks your identity against a document. I sent the application at 08:23. The approval came at 09:30, saying Anthropic had "adjusted the safeguards applied to your account to allow for the cyber use cases you described." Sixty-seven minutes from form to approval. I was impressed, and I went back to work expecting the blocks to stop.

The first one I wrote down came a month later.

What the approval covered

Here is what I have since pieced together from the help centre and from Anthropic's own emails. A verification applies to a list of models. Mine covered Opus 4.7, 4.8 and 5, and Sonnet 5. Fable 5, and then Fable 5.1, were never on it. Fable runs its own classifiers, which the help centre says are "designed to block access to Mythos-level capabilities", and it warns that on security work users "should expect high fallback rates". For anyone affected, it points to the Cyber Verification Program "for Opus".

So the verification I passed did nothing for the model I was using. None of that appears on screen when the block happens. The terminal says the safeguards "can sometimes flag legitimate coding and cybersecurity tasks", which reads like an apology for a rare slip. "Expect high fallback rates" is much closer to my experience, and it lives on a help page.

When the flag trips, Claude Code moves the conversation to Opus 4.8. That is documented too: the help centre names Opus 4.8 for cybersecurity requests, so that is where you land, whatever you would have chosen. You can turn the switching off in /config, in which case the request is refused outright. The notice is two lines in the middle of a long run of tool output, and more than once I only noticed the model had changed some way further down.

That switch costs more than it sounds. On 10 and 11 October I was reviving Tigris, my continuation of Tiger, a Unix security auditor built on twenty-five-year-old shell code. I put Fable on it so that nothing I changed would open a new hole, and Fable started finding old ones. Over those two days the classifier stopped it four times. Three of those times the rest of the task carried on with Opus 4.8, below the standard of the half Fable had already done. Reviving old code costs me money either way, and I would like to spend it on the best model I am paying for.

Four bug reports

I filed four reports on the Claude Code repository. Each carried the version number and a feedback ID, and the first two included the request ID as well.

  • #86071, 12 August. I had asked Claude to probe my own repository for exploitable paths and prove each finding with a proof of concept. A bot labelled it stale after fifteen days and closed it on 10 September as "inactive for too long".
  • #86197, the same evening. Another block, the same message. Marked stale on 28 August, closed on 11 September with the same words. The only person who replied was another developer with the same problem.
  • #98414, 30 September. The gitleaks file above. A bot labelled it a duplicate three minutes after I filed it. It is still open and nobody has commented.
  • #98921, 2 October, when Opus started doing the same. A bot closed it a week later for want of reproduction steps.

The last of those was one line written in a temper, and I would have closed it myself. The other three had everything anyone would need to investigate. No one from Anthropic commented on any of them. They were closed for inactivity, and nobody at Anthropic had touched them, so the inactivity was theirs.

I am far from the only one. On 13 October the Claude Code repository held 602 issues mentioning the Cyber Verification Program. Of those, 269 were open, most carrying a bot's duplicate label, and 263 of the closed ones had been closed as not planned. More than a dozen come from people who were already approved and are saying what I am saying. #84352, filed on 6 August, is an approved organisation still blocked in Claude Code. #88768 is titled "Constant model downgrades even with Cyber Verification approved". In #98153 the approval never reached Opus 5.5. #93224 matches my case most closely, down to the drop to Opus 4.8, and it is the one that now carries a label saying it has a reproduction. I added my evidence to it today.

Meanwhile, in northern Yemen

Anthropic's threat report for September describes a cell in northern Yemen running three weapons programmes, among them a guided rocket built around "a commodity phone-class flight computer with final-phase homing guidance" and a ballistic missile with "a stated range goal above 2,000 kilometres". Anthropic did not name the group. Most of the press named the Houthis, who hold most of northern Yemen.

In Anthropic's words, the actors "used Claude Code in place of human software engineers" to write the guidance, navigation and control software. They ran several sessions side by side, one writing code and another reviewing it, much as a lead engineer splits work across a small team. They test-fired a guided rocket. It seems to have failed, and "within hours, the actors returned to Claude to work out why it failed."

The safeguards stopped many of their requests and missed others. The ones that got through did so because the operators hid what the work was for and split it across separate conversations, so that no single one gave the project away. Anthropic banned the accounts once it caught on.

Anthropic would answer, with some justice, that none of this happened on Fable, and that Fable's classifiers exist because the newest models can do more than whatever the Yemen cell was using. I accept the premise. Look at what each side had to do to get its work done, though.

Who the classifier catches

A classifier reads the words in front of it. The people building a missile chose their words to hide what they meant and cut the job into pieces too small to look like anything. I wrote "probe this repository for exploitable paths, write the proof of concept" about a repository with my name on every commit. Out of context I can see why that tripped a wire: it is what an attacker would type. It is also what a penetration test is, and I saw no reason to dress it up.

A filter that works on wording ends up tuned against candour. Somebody with something to hide learns the workaround in an afternoon. The people it keeps stopping are the ones who say plainly what they are doing.

Verification is meant to close that gap. Anthropic knows who I am; it has seen my ID. The approval is tied to the same organisation Claude Code signs in with, and I have checked. It made no difference on the model I had chosen, because that model was never part of the deal, and nothing in the terminal ever said so.

I will not jailbreak it

The obvious workaround is to rephrase the request until the classifier stops objecting. I will not. It breaks terms I agreed to, and rewording my intent until a filter no longer recognises it is the technique the Yemen cell used. I would rather not pick up their habits to check my own code.

What changed last week

On 7 October Anthropic split the program into three tiers and wrote to say my organisation now has Defense Access. It covers Mythos 5.1, Opus 5.5 and Sonnet 5.5 for "vulnerability triage and verification, malware analysis and reverse engineering, detection engineering, and incident response" on systems you own or maintain. The verification portal now says my grants are issued.

It has not stopped the blocks. On 11 October, four days after the grant, Opus 5.5 stopped in the middle of a reply on Tigris with the category cyber. It was verifying a security bug in Tiger's own code, which is the first thing on the Defense Access list. Fable 5.1 is still not on that list at all, and the block message still does not say so.

If you do security work in Claude Code, this is what I would have liked to know in July:

  • The approval email lists the models it covers. Pick one of those for security work. It will not end the blocks, since Opus 5.5 refused me with a grant in place, but as far as I can tell Fable's classifiers apply whatever your verification status.
  • Check that the organisation in the approval is the one Claude Code is signed in to. A personal workspace does not inherit it.
  • If Claude Code switches you to Opus 4.8 mid-session, that is the Fable classifier. Turn the switching off in /config if you would sooner be told no.
  • The approval email links a false-positive escalation form, which is the channel Anthropic names. On GitHub, add your evidence to #93224 instead of opening a new issue; new ones are labelled duplicates within minutes.

What I would ask Anthropic for

Two things. The block message should say whether my verification applies to the model I am using, and if it does not, which model it does apply to. That is one sentence of copy, and it would have saved me three months.

A person should also read a safeguards bug report before a bot closes it. A verified customer blocked while writing a secrets-scanner config is precisely the false positive the people tuning these classifiers need to see. At present it gets a stale label.

My evidence now sits on #93224. If anyone from Anthropic replies there, I will update this entry.