Error messages

Opus 5.5's safeguards stopped the response above · continuing once with that noted

Opus 5.5's safeguards stopped the response above · continuing once with that noted

Claude Code prints this as a dim notice in the middle of a turn, usually right after a reply that stopped short:

Opus 5.5's safeguards stopped the response above · continuing once with that noted

It isn't an error yet. It means Anthropic's API ended the reply with a stop reason of refusal while it was still streaming, and Claude Code has decided to give the same model one more go. The model name in front changes with whatever you're running (the code fills it in), but nearly every report we found is from Opus 5.5.

Anthropic's error reference doesn't list this line as of October 8, 2026, so what follows comes from reading the 2.1.295 binary, plus the GitHub issues that quote it.

What Claude Code does before it continues

Three things happen between the cut and the retry. Whatever text had already arrived stays on screen. Any tool call in the stopped reply that hadn't finished gets a result written for it, and there are two:

Not run: the response that made this tool call was stopped by a safety classifier.

Interrupted: the response that made this tool call was stopped by a safety classifier while the call was running; it may have partially or fully completed.

The second is the one to look at. An edit or a shell command that was already running when the classifier fired may have done some or all of its work, so check the file or the command's effect before trusting what Claude says next.

Then Claude Code adds a note to the conversation that you don't see. It tells the model its reply "was stopped by a safety classifier", that this "is not a tool or API error", and: "Do not produce that content again, even reworded." That's the "with that noted" part. The model gets the same conversation back with that instruction on top, and the turn continues.

Why it's “once”

The retry is spent per prompt. After it fires, a flag is set, and a second refusal in the same turn goes straight to the normal error instead. The flag clears when you send your next message. If the retry is refused too, you'll see something like what one user got in September 2026 after typing “hi”:

API Error: Opus 5.5's safeguards flagged this message (https://www.anthropic.com/legal/aup). This sometimes happens with safe, normal conversations. Claude Code can't respond to this message with Opus 5.5.

That's the line our safeguards flagged this message page covers, including the Cyber Verification Program for people whose actual job is security work.

It doesn't retry in every case. When the turn was going to end anyway, it skips the retry, and the same goes for background helper requests. An environment variable, CLAUDE_CODE_DISABLE_REFUSAL_RETRY, switches it off. That variable is in the code but not on Anthropic's environment variable page (which does list CLAUDE_CODE_DISABLE_REFUSAL_FALLBACK, a different setting that stops the automatic switch to another model).

What the retry can cost

The retry is a full request. An open issue from September 26 measured what that means in a long session: the prompt cache written by the refused request was never reused, so the retry and the next message both paid to write the context again. With a warm cache, the reporter put it at about 20,000 extra tokens per refusal. Their conversation was about 700,000 tokens, though, and once the cache had gone cold each retry cost "~15% of a Pro 5-hour window", and "four refusals in 10 minutes exhausted my whole window". Nobody from Anthropic had answered it when we read it.

So if you're deep in a huge session and this notice keeps showing up, the retries themselves may be what's eating your limit.

When it keeps happening

• Press Esc twice (or run /rewind) to step back to before the turn, then rephrase. Anthropic's docs say the check reads the whole conversation, so repeating yourself in the same session usually trips it again.
• Try another model with /model. The model configuration page describes the automatic switch Claude Code can make on a flag, and the switchModelsOnFlag setting that controls whether it asks first.
• If it fires on the very first message of a session, suspect your setup. Per that same page, the first request carries your CLAUDE.md and git status, and a repository with security or biology material in it "can trip the classifier on that context alone". Starting with claude --safe-mode leaves your customizations out, which is a quick way to test that.

A refusal on something harmless is worth reporting with /feedback. It's the only route to the people who tune the classifier.