safeguards flagged this message: What It Means and What to Do When a Safety Classifier Stops Claude Code

"safeguards flagged this message" means that a safety classifier attached to the Claude model reacted to the content of your conversation and stopped that model from responding. It is not a Claude Code bug, and it is not a network failure. It can appear not only during cybersecurity or biology work but also on ordinary requests such as a greeting or a planning task, and Anthropic itself acknowledges that false positives can happen.

The message starts with the name of the model that was stopped. On GitHub Issues filed between September 22 and 29, 2026, the on-screen wording reported was mainly one of the following two (the line breaks are not exactly as shown on screen).

API Error: Opus 5.5's safeguards flagged this message (https://www.anthropic.com/legal/aup). This sometimes happens with safe, normal conversations. Claude Code can't respond to this message with Opus 5.5.

Double press esc to edit your last message, or try a different model with /model.

Send feedback with /feedback or learn more: https://support.claude.com/en/articles/8106465

Details: `[reasoning_extraction]`

API Error: Opus 5.5's safeguards flagged this session (https://www.anthropic.com/legal/aup). You may be seeing this for the first time on an Opus model: Opus 5.5 is more capable and has stronger safeguards as a result, which can sometimes flag non-cybersecurity work. We're improving these safeguards to reduce the amount of incorrectly flagged messages. Claude Code can't respond to your last message with Opus 5.5.

Double press esc to edit your last message, or try a different model with /model.

Send feedback with /feedback or learn more: https://support.claude.com/en/articles/8106465

Details: `[cyber]`

Issue titles often say "Message flagged by safeguards," but what actually appears on screen is the wording above. The Opus 5.5 part changes to Fable 5.1, Opus 5, Opus 4.8 and so on, depending on the model you were using.

1. What the message means—a classifier that read the conversation stopped it

According to the official Claude API documentation "Refusals and fallback," Fable 5.1, Fable 5, Opus 5.5, Opus 5 and Sonnet 5.5 come with safety classifiers that can refuse requests. When one refuses, the API does not return an error but a normal response (HTTP 200), with the stop reason set to stop_reason: "refusal" and the area of the refusal in stop_details.category. Claude Code receives this and shows it as a message starting with "API Error:".

The important point is that the classifier does not look only at the last sentence you sent. The Help Center article explaining the Opus 5.5 safeguards says the classifiers look at everything the model reads. That includes memory, connector content, web search results and files, so you can be stopped by content you never typed yourself.

On the third point, Claude Code's model configuration documentation states explicitly that a classifier can trigger on the first request of a session, before you have sent anything unusual. Because the first request includes the contents of CLAUDE.md and git status, a repository containing security or biology material can trigger the classifier through that information alone—that is the explanation. The fourth point corresponds to the API documentation saying that a refusal can arrive before the output or partway through it, and that in either case the partial output should be discarded as incomplete.

2. The wording differs by model and version

The same mechanism produces several different wordings. The current example listed in the official error reference looks like this.

API Error: Opus 4.8's safeguards flagged this message. Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate cybersecurity work. Apply to the Cyber Verification Program to reduce these interruptions. Send feedback with /feedback or learn more: https://support.claude.com/en/articles/14604842-real-time-cyber-safeguards-on-claude

The error reference goes on to say that on Opus 5.5 and Sonnet 5.5, the message starts with <model>'s safeguards flagged this session. The two messages quoted at the top of this article were pasted into Issues filed on or after September 22, 2026. Within what we read, the flagged this session message came with [cyber] or [bio], while the This sometimes happens with safe, normal conversations message mostly came with [reasoning_extraction].

The error reference says the classifiers themselves run on the server side and existed before v2.1.203; what later Claude Code updates changed was only the wording of the message. It is not the case that updating Claude Code is what started getting you stopped.

What changed in v2.1.284

The CHANGELOG for v2.1.284, released on September 28, 2026, has two entries related to this message.

• The notice shown when a Sonnet model's safeguards flag a message was changed to explain why it happened and to offer the option of editing and resending.
• Safeguard-triggered model switching was changed for sessions that pin an Opus model with ANTHROPIC_DEFAULT_OPUS_MODEL or modelOverrides. On the Anthropic API, the API now picks the fallback model for each type of flag, rather than using the pinned model.

As of September 29, the wording of the new Sonnet notice was not listed in the official error reference, and it had not been pasted into any of the Issues we read.

3. The Details categories, and whether the model switches

The word in Details: at the end of the message matches the value of stop_details.category returned by the API. The API documentation lists five categories. Note that every category except reasoning_extraction carries a note that it can also trigger on benign work.

Sources: the category table in Claude API "Refusals and fallback," Automatic model fallback in Claude Code "Model configuration," and the Help Center article "Why Claude switched models in your conversation with Opus 5 or Opus 5.5" (all checked on September 29, 2026).

When a switch happens

By default, when Claude Code is stopped in a category that has a fallback, it automatically resends the same request on the fallback model and posts a notice in the conversation. The rest of the session continues on the fallback model. To go back to the original model, pick it again with /model.

The Help Center cautions, however, that even if you switch back to the original model, the same safeguards may switch you again if the flagged request is still in the conversation, and that editing the earlier message before resending often helps. Typical situations where the switch does not help and you end up stopped with a message like the ones at the top are: being stopped in a category with no fallback, such as reasoning_extraction; being stopped on the fallback model as well; the fallback model not being allowed by availableModels; and running in a non-interactive mode such as -p with the "ask before switching" setting enabled.

4. Did you do something wrong? What Anthropic says about false positives

If you feel "I didn't do anything wrong, and I still got stopped," that is entirely possible. Anthropic's documentation clearly acknowledges false positives in several places.

On the other hand, the Help Center article linked from the message (Our Approach to User Safety) says that users who repeatedly violate the policies may temporarily have safety filters with heightened detection applied to them. Whether times you were stopped by false positives count toward this is not stated officially. After being stopped, it is safer to switch conversations using the steps in Section 6 than to keep throwing the same request at it with only the wording changed.

How to think about a reasoning_extraction stop

The Help Center gives examples of what this category stops: requests to repeat its reasoning word for word, or to write out its full chain of thought into external output. On the other hand, it says you can still have Claude explain its reasoning, teach a concept, or walk through a code review step by step, and that conversational questions such as "why did you do that?" are not affected.

Reading the Issue reports, there were cases where the stop came right after requests like the following. All are user reports, and Anthropic has not explained why the classifier reacted.

• Asked whether the screen could show its "thinking" instead of the tool calls (#96118)
• Had a subagent quote, from its context, the line naming the model it was running on (#96139)
• At the end of a long task, had it write a summary of the session to a file (#96874)
• Asked it to annotate a design diagram with "the options considered and why they were rejected" for each decision (#98108)

What they have in common is asking the model to write out "its thought process" or "its own context" as-is. If you need that as a deliverable, switching to wording that asks for a short summary of the result, such as "the conclusion and the reasons for choosing it, in three lines," moves the request toward the "explain its reasoning" side that Anthropic describes as allowed. That said, there are cases like the additional report on #96118, where a short question in German alone was stopped, so rephrasing is not guaranteed to avoid it.

5. Cases reported since September 22

Since Opus 5.5 was released on September 22, 2026, reports of this kind have been piling up in the anthropics/claude-code Issues. When we counted with GitHub search on September 29, there were 67 Issues created between September 22 and 28 containing "safeguards" in the title or body (7–12 per day; the count changes depending on the search terms). In the Issues from September 22 onward that we read, we found no replies from Anthropic staff, and many carried the "duplicate" label.

The cases stopped by just a greeting might be explained by the official statement in Section 1 that "the classifiers look at the whole conversation and the workspace information." The idea is that even if the last message was harmless, the classifier reacted to CLAUDE.md, the earlier exchange or files that had been read. However, none of the reports shows what it reacted to, and no way of checking this has been published.

6. What to do when you get stopped

These are the steps listed by the official error reference and the model configuration documentation, arranged from least to most effort. If it happened only once, step 3 will usually be enough.

If you'd rather choose each time than switch automatically

If you feel the quality of the work drops on the fallback model, turn off "Switch models when a message is flagged" in /config, or write the following in your settings file. The session will then pause each time it is stopped and let you choose between switching to the fallback model and editing the prompt to resend it on the current model.

{
  "switchModelsOnFlag": false
}

However, for categories with no fallback (such as bio on Sonnet 5.5 or Opus 5), no choice is offered and it ends in a refusal. In the non-interactive -p mode, and in SDK integrations that cannot show a prompt, the stopped turn also ends in a refusal. In cloud sessions used from the mobile app, the option to edit and resend is not available.

If it stops during /compact

Compacting a conversation also has the model read the whole conversation, so it can be stopped too (#96648). The v2.1.282 CHANGELOG says it fixed compaction failing when the summary request was refused, and that it now retries on the fallback model. If claude --version shows a version older than 2.1.282, update first with claude update. We cover when compaction is worth using in our article on when to run /compact.

7. Does the Cyber Verification Program (CVP) help?

CVP is a free application program that makes it less likely for people doing cybersecurity work for legitimate defensive purposes to be stopped by the safeguards. The Help Center's CVP article divides the work that gets stopped into two kinds.

The key point here is that as of September 29, 2026, CVP does not apply to Opus 5.5 or Sonnet 5.5. The CVP article says at the top that it applies to Opus and Sonnet models but not to Opus 5.5 and Sonnet 5.5, and that it will soon be extended to Opus 5.5, Sonnet 5.5 and Mythos-class models. Both the Opus 5.5 announcement and the Sonnet 5.5 announcement also describe the CVP expansion as coming "soon." The reports we saw in Section 5 of "CVP-approved but still stopped on Opus 5.5" are consistent with this explanation.

The Opus 5.5 Help Center article offers one more clue: a sentence saying that organizations already using Opus 4.8 through CVP can start using Opus 5, which has fewer cyber restrictions, right away. If you are approved and still being stopped by Opus 5.5, picking Opus 5 or Opus 4.8 with /model for now is the workaround that follows the official explanation.

For organizations whose biology research is stopped by [bio], there is a separate vetting program called the Life Sciences Verification Program (LSVP). The Opus 5.5 announcement says that organizations that pass the review can use Opus 5.5 for their research.

8. Billing for stopped requests, and unfinished work

Billing depends on the category and on when it stopped

According to the API documentation and the Help Center, stopped requests are billed as follows. In every case, they count toward your rate limits (usage limits).

If you use a subscription, the effect shows up in how fast your usage limit drains. The reporter of #97335 writes that the prompt cache written by a stopped request was not used by the next request, so in a long conversation of about 700,000 tokens, every stop meant rewriting the entire conversation. They observed using up a Pro plan's 5-hour window with four refusals. It is a report not confirmed by Anthropic, but if you keep getting stopped in a long conversation, switching with /clear costs you less of your limit than persisting in the same conversation.

Half-finished file operations can be left behind

The API documentation asks that the output of a response stopped partway be discarded as incomplete. The note Claude Code adds to the conversation after being stopped, in the text pasted into #97335, also says that tool calls that had not finished were not executed.

However, #97311 reports four cases where the model was stopped while writing a file edit (Edit), a file write (Write) or a Bash call, and the truncated content was executed as-is (v2.1.219–2.1.280, on a single Linux machine). For Edit and Write, "success" was displayed, but the written file or the rewritten lines were cut off partway. There is no official response yet, but right after being stopped, it is safest to check the changes with git diff before moving on, as in step 2 of Section 6.

# List files that changed
git status

# Look at the contents for edits that were cut off partway
git diff

# Restore one file to its state at the last commit (after checking)
git restore path/to/file

Changes made with Claude Code's file editing tools can also be undone with checkpoint rewind. However, files rewritten through Bash are not covered by rewind.

9. What is confirmed and what is not

10. Summary

"safeguards flagged this message" means that the model's safety classifier reacted to the content of the conversation and stopped that model from responding. The classifiers run on the server side and look not only at the last message but at the whole conversation, the files that were read, and even CLAUDE.md. Both the message itself and the official documentation acknowledge that ordinary conversations can be stopped too.

When you are stopped, first look at the category in Details:, and if a file operation was in progress, check it with git diff. Then try, in order: go back with Esc twice and rephrase, start a new conversation with /clear, and switch models with /model. If [cyber] is blocking your work, CVP is an option, but as of September 29, Opus 5.5 and Sonnet 5.5 are not yet covered. For the overall picture of the model-side safeguards, see our Opus 5.5 explainer; for other "blocked by a filter" messages, see our article on The model returned no content; and for other errors, see our roundup of common Claude Code errors and fixes.

FAQ

Q. What does "safeguards flagged this message" mean?
A. It means the safety classifier of the model you were using (such as Opus 5.5 or Fable 5.1) reacted to the content of the conversation and stopped the response. It is not a Claude Code malfunction or a network error. Details: on the last line contains the name of the category that reacted.

Q. I only sent "hi" and got stopped. What did I do wrong?
A. Your last message is not necessarily the cause. The classifiers look at the whole conversation, the files that were read, and even CLAUDE.md and git status. If you launch with claude --safe-mode and are not stopped, it may have reacted to the content of the settings or files being loaded. If you think it's a false positive, report it with /feedback.

Q. Could my account be suspended?
A. The Claude Code documentation says that model switches during security or biology work are expected routing, not an account flag. On the other hand, a Help Center article says that users who repeatedly violate the policies may temporarily have stronger filters applied, and whether false positives count toward that has not been disclosed.

Q. Why am I stopped even though I have CVP approval?
A. Because as of September 29, 2026, CVP does not apply to Opus 5.5 or Sonnet 5.5. Anthropic says it will be extended soon. Anthropic also writes that organizations already using Opus 4.8 through CVP can use Opus 5 with fewer cyber restrictions, so for now the workaround is to pick Opus 5 or Opus 4.8 with /model. Also check that the organization ID tied to your approval matches the organization you are using.

Q. It keeps stopping no matter what I send in the same conversation. What should I do?
A. While the flagged content remains in the conversation, anything you send tends to get the same judgment. Press Esc twice to go back to a turn before the stop, or start a new conversation with /clear. You can open the original conversation with /resume, but resuming brings the flagged content back with it.

Primary sources we consulted

• Claude Code — Error reference (official documentation): Safety measures flagged a cybersecurity topic (current and older wording, v2.1.203 and v2.1.219), Usage Policy refusal, Responses seem lower quality than usual
• Claude Code — Model configuration (official documentation): Automatic model fallback, Check what triggered fallback, Ask before switching, Security research and biology workloads
• Claude Code — Settings reference (official documentation): switchModelsOnFlag
• Claude Code — Checkpointing (official documentation): Esc twice and /rewind, what rewind covers
• Claude Code — Changelog (official): the entries for v2.1.282 and v2.1.284
• Claude API — Refusals and fallback (official documentation): the list of categories, how billing works
• Claude Help Center — Why Claude switched models in your conversation with Opus 5 or Opus 5.5: switching by category, the distillation category, the relationship to CVP, billing
• Claude Help Center — Real-time cyber safeguards on Claude Opus and Sonnet: CVP coverage, applications and appeals
• Claude Help Center — Our Approach to User Safety: detection models and safety filters
• Anthropic — Claude Opus 5.5, Claude Sonnet 5.5 (the Safeguards section of each announcement)
• GitHub Issues: #96090, #96118, #96139, #96298, #96495, #96592, #96648, #96874, #97311, #97335, #97373, #97452, #97492, #97560, #97605, #97891, #97946, #98108 (all user reports; checked September 29, 2026)