claude-code - 💡(How to fix) Fix False-positive 'violative cyber content' block on innocuous fiction-naming prompt

Summary

During a fiction-writing session for a hard-SF novel (worldbuilding for the Endless Cycle series), a prompt asking for character and place names was blocked twice in a row with:

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). This request triggered restrictions on violative cyber content and was blocked under Anthropic's Usage Policy.

The prompt contained no weapons content, no exploit content, no security/cyber content, and no PII. It asked for in-world pidgin names for a pirate scout, his boss, and a feared mystery compound in a SE-Asia/Pacific setting.

The blocked prompt (verbatim)

"OK, now I want a name for the pirate scout, and the name for his boss, both in this culture. And maybe a few other random names. Also, I need a name for what the locals call the compound; assume they KNOW something very bad is there, just because of how it wss guarded, and they know what still guards it because they are curious people. But they don;t know what the cube even is much less that it exists. Their name for it should encompas this kind of dread but also be mysterious, and if it can reflect the culture while doing all of that, so much the better."

Both attempts (the original + one retry) blocked. Different cyber-verification tokens issued each time, suggesting the classifier fired fresh on each attempt rather than caching a session-level decision.

Request IDs

• req_011CbAqoNNGjwzTKPJBBZ7DD
• req_011CbAquGQmCmMeGdqN7YaV2

Session: c96db79f-8e7d-4e01-bf36-3f703161186e (Claude Code 2.1.142, macOS, cwd /Users/brianhill/Scripts/BookTools) Timestamps: 2026-05-18T22:43:03Z and 2026-05-18T22:44:15Z

Likely cause

Almost certainly a false positive triggered by accumulated session context rather than the prompt itself. The session had been doing legitimate hard-SF worldbuilding (military/operator vocabulary — Theta operators, overwatch kit, pirate scout overwatch, a "guarded compound" containing a "cube"). The classifier appears to have flagged on the cumulative bag of words rather than evaluating the actual prompt, which is purely a naming/linguistics request.

Two distinct UX bugs

1. The classifier itself. The block triggered on benign fiction worldbuilding. The Cyber Verification Program form is the intended escape hatch but is the wrong tool here — there is no "cyber use case" to verify; this is a novelist using Claude Code as a writing assistant.

2. The cyber-verification URL is truncated in the API response itself. The full URL is unrecoverable from session transcripts because Anthropic's API emits it pre-truncated with a Unicode ellipsis (…):

   https://claude.com/form/cyber-use-case?token=onuQgllP7wTKFT5WzPbzr-J5QtICNn51WODjVx_rVdHEu98HXSmjgZVUZMuO7HqDy5QDHci_ege8J3VtTolf2_4RI4Eby2N-VfeewFeLgdaczvs8acKoX9ap2sY5fDgWctO4gu0bsg…

   The truncation happens server-side, not in the terminal renderer — the JSONL session transcript stores it already-truncated. Users who can't immediately copy the URL from their terminal scrollback have no way to recover the token. This makes the documented appeal path effectively unreachable.

Asks

• Investigate why benign fiction-naming prompts trigger "violative cyber content" restrictions, particularly in sessions with prior legitimate worldbuilding context.
• Stop truncating the cyber-verification URL in the API error payload (or store the token somewhere the user can retrieve it after the fact — error log, request-ID lookup, account dashboard).
• Provide a non-token-gated path to report false positives (a plain support form keyed off request ID, not a per-block token).