Error messages

Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate cybersecurity work.

Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate cybersecurity work.

This is Anthropic's cybersecurity classifier declining a request, reported by Claude Code with the name of whichever model was running. The full line from a September 2026 report on Sonnet 5 reads:

API Error: Sonnet 5's safeguards flagged this message. Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate cybersecurity work. Apply to the Cyber Verification Program to reduce these interruptions. Send feedback with /feedback or learn more: https://support.claude.com/en/articles/14604842-real-time-cyber-safeguards-on-claude

  Details: `[cyber]`

It isn't the same message as the general Usage Policy refusal, though both come out of one function in Claude Code 2.1.282. As of September 25, 2026, 551 issues in the anthropics/claude-code repo mention "cyber safeguards" and 563 mention the Cyber Verification Program.

When you get this line and when you get another

Reading the 2.1.282 code, this exact wording needs three things at once. The API has to tag the refusal as cyber, you have to be on Anthropic's own API rather than Bedrock, Agent Platform or Foundry, and the model you're on can't have a fallback model to hand the request to. Opus 4.8 fits that last condition (it's the model the others fall back to for cyber flags, so there's nowhere further down to go).

On Opus 5.5 you'll see something longer, which needs v2.1.280 or later:

API Error: Opus 5.5's safeguards flagged this session (https://www.anthropic.com/legal/aup). You may be seeing this for the first time on an Opus model: Opus 5.5 is more capable and has stronger safeguards as a result, which can sometimes flag non-cybersecurity work.

On Amazon Bedrock, Google Cloud's Agent Platform and Microsoft Foundry, a cyber flag arrives as the ordinary Usage Policy line instead. Older builds used other wordings too. From v2.1.203 to v2.1.218 it said the model "has safety measures that flagged this message for a cybersecurity topic", and before that it offered an exemption form.

Why ordinary coding trips it

The message says it in so many words: the safeguards are "intentionally broad". Anthropic's help center splits what they block into two groups. Prohibited use, such as ransomware development or mass data exfiltration, stays blocked for everyone. High-risk dual use, such as exploit work or offensive security tooling, is blocked by default and can be loosened for verified defenders. Anything near those lines can catch, and the reports show plenty of work that isn't near them at all, like reviewing a frontend page and its disclosure text.

Claude Code's model docs are direct about security researchers. Penetration testing and CTF exercises "trigger fallback frequently, often on the first request", and the docs call that "expected routing for these domains, not an account flag". I'd half expected a flag to count against the account somehow. Per the docs it doesn't.

The automatic switch to Opus 4.8

On Fable 5.1, Fable 5, Opus 5.5 and Opus 5, a cyber-flagged request normally doesn't stop you. Claude Code reruns it on Opus 4.8 and leaves a notice in the transcript, and the session stays on Opus 4.8 until you change it with /model. Turn off Switch models when a message is flagged in /config and it pauses to ask instead. There's one more notice worth knowing, safeguards stopped the response above · continuing once with that noted, which Claude Code shows when a reply is cut off partway and it tries once more on the same model. In one report that notice came right before the full cyber error, so it isn't always the end of it.

The Cyber Verification Program, and what it doesn't cover yet

The program is free, you apply for it, and it's meant for people doing legitimate defensive work that lands in the dual-use group. On Anthropic's first-party products you apply through the Verification Portal, but only an organization's authorized admins see the option. Identity verification is part of it, and Anthropic aims to email a decision within two business days. Organizations on zero data retention aren't eligible yet, and it isn't offered on Bedrock.

Here's the part I didn't expect. The help article opens by saying it doesn't apply to Claude Opus 5.5, with the program due to reach Opus 5.5 "soon". That explains a September report from a program member, a bug bounty hunter who was still blocked on Opus 5.5 after updating to 2.1.280. Membership didn't carry over to the newer model.

For a single flag in the meantime, press Esc twice or run /rewind to step back before the turn that set it off. If what you were doing had nothing to do with security, /feedback with the Request ID is how the docs say to report it. On the API, a cyber refusal that arrives before any output isn't billed.