[Bug] Classifier over-triggering false positives in tool execution validation

Bug Description
Concrete false positive from today, same class of problem:

Request ID: req_011CfBjvVkfDJU8QETaxWYVs (2026-09-19, model claude-fable-5, Claude Code CLI)
Details tag: [cyber]

What was flagged: a long coding session doing statistical experiments on synthetic byte-level data. The turn described a data-integrity check on the project's OWN artifacts: "flip one byte in the archive, the verifier must refuse it" — plus SHA-256 hashes and words like "corrupted", "refused", "probe". That is standard verification discipline (falsify your own test), not an attack on anything. No network, no third-party target, no exploit — local files the session itself generated.

The result: mid-session hard stop, "Claude Code can't respond to this message with Fable 5", work interrupted.

If describing a red-team check of one's own test suite trips [cyber], every developer who takes testing seriously is a false positive. Please tune on this request ID.

Environment Info

• Platform: darwin
• Terminal: Apple_Terminal
• Version: 2.1.269
• Feedback ID: 3ad55007-aac1-423e-8ef8-eb305232a472

Errors

[]

PLEASE: CALM YOUR CLASSIFIERS DOWN! IT'S IMPOSSIBLE TO WORK! WHILE YOU'RE THINKING ABOUT DESTINY OF HUMANITY - YOU'VE ABSOLUTELLY FORGOT ABOUT DEVELOPERS WHO LOVE CLAUDE AND STILL STAY LOYAL TO ANTHROPIC DESPITE DRACONIC LIMITS AND DUMB-CLASSIFICATORS.

No files, tests, or entry points are identified in the report. Start by locating the tool-execution validation classifier and reproduce the false-positive behavior on the reported darwin environment; done means the triggering case is understood and validation no longer rejects legitimate tool execution without regressing existing checks.