[BUG] Opus 5 safeguards false-positive on legitimate bacterial genomics research (`[bio]` flag)

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

## Summary
Switching the model to Opus 5 (`claude-opus-5`) mid-session caused every subsequent
message to be rejected by Opus 5's automated safety classifier with a `[bio]` flag,
even though the conversation was legitimate academic bioinformatics work (bacterial
whole-genome sequencing analysis for a manuscript revision). Switching back to
Sonnet 5 (`claude-sonnet-5`) resolved the issue immediately in the same session.

## Environment
- Client: Claude Code desktop app (Code tab)
- Models involved: `claude-opus-5` (fails) / `claude-sonnet-5` (works)
- Platform: Windows 11

## Steps to reproduce
1. Start a Claude Code session doing bacterial genome analysis (ANI, dDDH,
phylogenomics, gene cluster annotation) in the context of a manuscript revision
that discusses *Mycobacterium tuberculosis*, multidrug-resistant TB (MDR-Mtb),
and gut microbiome/bile-acid-producing bacteria.
2. Mid-session, run `/model claude-opus-5`.
3. Send any follow-up message continuing the same analysis.

Additional occurrence (this session)
- Session ID: c5d62d3e-1421-4d1c-9a96-535bb6e4d49e
- Project context: Same category of work — bacterial WGS analysis for a manuscript/abstract (KSID 2026 conference submission), specifically Klebsiella pneumoniae carbapenemase genes (blaKPC-2, NDM-1, OXA-181), hypervirulence plasmid elements (rmpA2/iuc aerobactin operon), ICEKp mobile elements, and phylogenomic reconstruction — clinical AMR/virulence surveillance, not dual-use.
- Repro steps:
1. Mid-session, ran /model claude-opus-5.
2. Sent a routine follow-up: "추가로 분석 가능한 부분 확인해줘" ("check what else can be analyzed") — a plain continuation of the same genomics review, no new sensitive content.
3. The message produced no assistant response at all in the transcript (silent failure — unlike your case, no visible error banner text reached the conversation log, only an empty turn).
4. Ran /model claude-sonnet-5 and resent essentially the same request — it succeeded immediately and produced a normal detailed response continuing the same analysis.
- Note/caveat for your report: I (the assistant) don't have access to the actual error banner or req_id for that blocked turn — that only appears in your client UI, not in what's passed to me. If you still have that session open, it's worth grabbing the banner text/req_id from that turn directly, the same way you captured req_011Cew1DEtrfpxgcqoTNXMmU for the other one. But the pattern (Opus 5 blocks a benign genomics continuation → identical prompt on Sonnet 5 works) is consistent with your bug and gives you a second independent session confirming it.

## Actual behavior
Every message is rejected with:

### What Should Happen?

Legitimate, non-dual-use academic microbiology/genomics research (species
identification via ANI/dDDH, gene annotation, phylogenetics) should not be blocked.

### Error Messages/Logs

```shell
API Error: Opus 5's safeguards flagged this message (https://www.anthropic.com/legal/aup).
Our intentionally broad safeguards allow us to deliver more capabilities faster, but can
sometimes flag legitimate coding, cybersecurity, and biology tasks. Claude Code can't
respond to this message with Opus 5.

Try rephrasing the request in a new session or change your model.

Learn more: https://support.claude.com/en/articles/16049681

Details: [bio]

Request ID: req_011CevzjmGC948XBSia72XsQ

API Error: Opus 5's safeguards flagged this message (https://www.anthropic.com/legal/aup). Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate coding, cybersecurity, and biology tasks. Claude Code can't respond to this message with Opus 5.

Try rephrasing the request in a new session or change your model.

Learn more: https://support.claude.com/en/articles/16049681

Details: `[bio]`

Request ID: req_011Cew1DEtrfpxgcqoTNXMmU
```

### Steps to Reproduce

1. Open Claude Code (desktop app), start a new or existing session.
2. In the session, discuss/work on bacterial genomics content that
references pathogen names, e.g.:
- Mycobacterium tuberculosis, multidrug-resistant Mtb (MDR-Mtb)
- bacterial strain whole-genome sequencing, ANI/dDDH species comparison,
gene cluster annotation (e.g., discussing a manuscript revision about
gut microbiome bacteria and their effect on TB infection)
3. Mid-session, switch the model with:
/model claude-opus-5
4. Send any follow-up message continuing the same conversation/task
(no new sensitive content, just continuing the existing analysis).

Result: The request is immediately rejected with:
"API Error: Opus 5's safeguards flagged this message ... Details: `[bio]`"
(Request ID: req_011CevzjmGC948XBSia72XsQ)

5. Without changing anything else, run:
/model claude-sonnet-5
6. Resend the exact same message.

Result: The message is processed normally with no safety block.

This confirms the block is specific to Opus 5's safety classifier reacting to
the accumulated biology/pathogen-related conversation context, not to the
content of any single message (the same message succeeds on Sonnet 5).

### Claude Model

None

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

_No response_

### Claude Code Version

1.52386.0

### Platform

Anthropic API

### Operating System

Windows

### Terminal/Shell

WSL (Windows Subsystem for Linux)

### Additional Information

_No response_

No repository file, test, or entry point is identified in the report. Start by reproducing the model switch from claude-opus-5 to claude-sonnet-5 using the listed bacterial-genomics context, and compare the blocked and successful requests using the supplied request IDs. Done would mean the legitimate continuation is no longer falsely rejected by the Opus 5 safeguard.

Rédigé par le modèle d'indexation à partir du texte de l'issue.