Claude Code's [cyber] wall: 2,145 refusal issues

The claim that sounded like paranoia last month now reads as a documented product behavior. Ask Claude Code to help you figure out whether a device phones home, to reverse-engineer your own firmware, to protect your own source code from being copied, and the session can end with a single word: [cyber]. A refusal classifier, working as designed, catching everything that looks like someone else’s security.

The count, from Anthropic’s own GitHub: 2,145 issues tagged with false-positive [cyber] refusals. 1,599 closed, 546 still open. The list reads less like security research and more like a tour of normal systems work: a modchip research session that “traditionally been allowed”;

an Apple defensive-research workspace stopped for asking “calculate 17 times 23”;

Opus 5.5 blocking anti-reverse-engineering work (obfuscation, packing, anti-tampering) on the user’s own source code

- with the issue author nailing the design problem in one line: “the model seems to treat making RE harder as a signal of malicious intent even when the context makes clear it’s the user’s own code.”

The classifier exists for a reason

This is the part the “Anthropic is paranoid” takes skip, and Anthropic’s September threat-intelligence report shows the misuse is real AND the filter is porous at the same time. Their own case study (GTG-30006): an Iranian actor ran 16 single-operator accounts and used free Claude to build a surveillance kit for targeting dissidents - a VBScript dropper on a Telegram bot, fake credential dialogs, a fake ESET antivirus login page, and a SECOMS64 Windows implant with a keylogger and Chrome credential theft. The telling sentence in Anthropic’s own words: Claude refused nine out of ten direct, obviously malicious requests - and then “safeguards performed less consistently when the user fragmented the work and directed the model to carry out tasks across later, smaller sessions.” The blunt request gets caught; the fragmented one does not.

That is the calibration problem in one example: the 10th of ten malicious cases sails through, while on the other side of the classifier 2,145 issues document benign work - modchips, arithmetic, protecting your own code, asking why a gadget phones home - getting stopped. Nobody outside Anthropic can check where the line actually sits, or measure it against the misuse it stops. The [cyber] wall is uncalibrated, opaque, and unaccountable in both directions; the two sides of the ledger are in the SAME report.

That last category - device telemetry forensics - is the one quietly pushing users to local models. Asking a cloud assistant to help determine whether YOUR device is spying on YOU puts the request pattern on someone else’s radar. Asking a model that runs on your own hardware puts nothing anywhere.