Hi, Since the Opus 5.5 launch, Claude Code constantly interrupts me with this: Opus 5.5’s safeguards flagged this session. […] Opus 4.8 is answering instead, or you can edit and retry with Opus 5.5. Details: [cyber] It happens almost exclusively in Claude Code , not the web app (I’ve only hit it twice on claude.ai). Which makes me think the [cyber] classifier over-reacts to anything that looks like a shell command in a terminal context. Concrete example. My Serena MCP server dropped its connection, so I re-ran the exact command from their docs to restart it: uvx --from git+https://github.com/oraios/serena serena start-mcp-server --context ide-assistant That’s it. uvx fetches and runs the Serena MCP server in one shot, no permanent install. Serena is a well-known open-source tool that gives Claude persistent memory across sessions. I’ve used it for a while, it’s completely benign. Re-running that one command triggered the [cyber] flag and bumped me to Opus 4.8. Anthropic says these safeguards fire in “less than 5% of sessions” and are tuned conservatively on purpose. I get being cautious with a more capable model. But flagging a routine uvx command to start a memory MCP is a textbook false positive, and it happens often enough that the model I’m paying for feels like a coin flip in Claude Code. Anyone else getting the [cyber] flag on normal dev commands? What sets it off for you? submitted by /u/zlp3h
Originally posted by u/zlp3h on r/ClaudeCode