alt Hacker NewsThey've increased their cybersecurity usage filters to the point that Opus 4.7 refuses to work on any valid work, even after web fetching the program guidelines itself and acknowledging "This is authorized research under the [Redacted] Bounty program, so the findings here are defensive research outputs, not malware. I'll analyze and draft, not weaponize anything beyond what's needed to prove the bug to [Redacted].
I will immediately switch over to Codex if this continues to be an issue. I am new to security research, have been paid out on several bugs, but don't have a CVE or public talk so they are ready to cut me out already.
Edit: these changes are also retroactive to Opus 4.6. I am stuck using Sonnet until they approve me or make a change.
Replies
⎿ API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). This request triggered restrictions on violative cyber content and was blocked under Anthropic's
Usage Policy. To request an adjustment pursuant to our Cyber Verification Program based on how you use Claude, fill out
https://claude.com/form/cyber-use-case?token=[REDACTED] Please double press esc to edit your last message or
start a new session for Claude Code to assist with a different task. If you are seeing this refusal repeatedly, try running /model claude-sonnet-4-20250514 to switch models.
Worse, I have had it being sus of my own codebase when I tasked it with writing mundane code. Apparently if you include some trigger words it goes nuts. Still trying to narrow down which ones in particular.
Here is some example output:
"The health-check.py file I just read is clearly benign...continuing with the task" wtf.
"is the existing benign in-process...clearly not malware"
Like, what the actual fuck. They way over compensated for the sensitivity on "people might do bad stuff with the AI".
Let people do work.
Edit: I followed up with a plan it created after it made sure I wasn't doing anything nefarious with my own plain python service, and then it still includes multiple output lines about "Benign this" "safe that".
Am I paying money to have Anthropic decide whether or not my project is malware? I think I'll be canceling my subscription today. Barely three prompts in.
With all the low quality code that's being generated and deployed cybersecurity will be the golden goose.
Maybe stick with 4.6 until the bugs are worked out? Is this new filter retroactive?
Having tried codex for some security practice, it is similarly terrible.
You can link it to a course page that features the example binary to download, it can verify the hash and confirm you are working with the same binary - and then it refuses to do any practical analysis on it
i think updating fixed this for me?
They don't want competition, they are going to become bounty hunters themselves. They probably plan on turning this into a part of their business. Its kinda trivial to jailbreak these things if you spend a day doing so.
>even after acknowledging "This is authorized research under the [Redacted] Bounty program, so the findings here are defensive research outputs, not malware. I'll analyze and draft, not weaponize anything beyond what's needed to prove the bug to [Redacted].
What else would you expect? If you add protections against it being used for hacking, but then that can be bypassed by saying "I promise I'm the good guys™ and I'm not doing this for evil" what's even the point?
Sounds like you will need to drink a(n identity) verification can soon [1] to continue as a security researcher on their platform.
1: https://support.claude.com/en/articles/14328960-identity-ver...
Identity verification on Claude
Being responsible with powerful technology starts with knowing who is using it. Identity verification helps us prevent abuse, enforce our usage policies, and comply with legal obligations.
We are rolling out identity verification for a few use cases, and you might see a verification prompt when accessing certain capabilities, as part of our routine platform integrity checks, or other safety and compliance measures.