Claude safeguards flagged this session: what now

What "safeguards flagged this session" means

Claude's "safeguards flagged this session" message means a safety classifier stopped a request in your current Claude Code conversation. Anthropic puts it under cybersecurity flags. It is a refusal of that request. None of the Anthropic pages that describe this message mention any action against your account.

People often search two other messages along with it. API Error: Sonnet 5 can't help with this. Start a new session to continue. is Claude Code's Usage Policy refusal. We are unable to complete this request because it was blocked under Anthropic's usage policy does not appear on any Anthropic page we could find. This guide covers each message in turn. For each one, it gives only what Anthropic documents about how far the message reaches and the next step Anthropic names.

One rule covers the whole page. It does not teach you how to reword a request so that it gets past a safeguard. Your legitimate options are a new session, a request that is actually different, the feedback route, and the Cyber Verification Program or the appeal form where they apply. If Claude Code refused because you asked it to rebuild a known game, read why Claude Code won't recreate an existing game. That page covers this one case.

Which Claude refusal message do you have?

Compare the first words of the message on your screen with this list.

• <model>'s safeguards flagged this session: a cybersecurity flag, as printed by models that have automatic model fallback. Anthropic documents this opening for Opus 5.5 and Sonnet 5.5 in Claude Code.
• <model>'s safeguards flagged this message: the same cybersecurity flag, as printed by other models.
• <model> can't help with this. Start a new session to continue: a Usage Policy refusal in Claude Code.
• We are unable to complete this request because it was blocked under Anthropic's usage policy: not documented by Anthropic.
• API Error: Output blocked by content filtering policy: a separate case. The API's output content filter stopped the response. Claude Code sends the request again once by itself, and it shows this message only when the filter stops the second response too.

Claude Code's error reference puts the first two under one heading, "Safety measures flagged a cybersecurity topic". The third has its own section, "Usage Policy refusal". All of these are refusals of a request. Usage limits are a different problem with their own messages, and what to do when you hit a Claude usage limit covers those.

"Opus 5.5's safeguards flagged this session" in Claude Code

Anthropic documents only the opening of this message. The Claude Code error reference says this in its section on cybersecurity flags:

Models with automatic model fallback print a different message, without this link; on Opus 5.5 and Sonnet 5.5 it opens with <model>'s safeguards flagged this session.

Anthropic does not publish the rest of the text. You may have seen a longer version quoted on a forum or in a bug report. That wording comes from a user, not from Anthropic, so treat it as unconfirmed.

This version of the message comes from a feature called automatic model fallback. When a classifier flags a request, Claude Code can run it again on another model instead of refusing it. The model configuration docs list where each model falls back to:

• Opus 5.5, Fable 5 and Fable 5.1: cybersecurity flags run again on Opus 4.8, and biology flags run again on Opus 5.
• Sonnet 5.5: cybersecurity flags run again on Sonnet 5. Biology flags end with a refusal, because Sonnet 5.5 has no biology fallback model.
• Opus 5: cybersecurity flags run again on Opus 4.8. Biology flags end with a refusal, because Opus 5 runs its own biology classifiers with no fallback model.

When a fallback happens, Claude Code shows a notice in the transcript, and the session continues on the fallback model. Run /model to go back to your original model. Fallback by category needs Claude Code v2.1.219 or later.

The docs also list cases where a flag ends in a refusal instead of a switch. The flagged category may have no fallback model, such as a biology flag on Sonnet 5.5. Your availableModels setting may block the fallback model. In that case the refusal is shown as a normal error, and the session's model does not change. You can also set Switch models when a message is flagged to Ask each time in /config, which is the switchModelsOnFlag: false setting. Claude Code then pauses and gives you two choices: switch to the fallback model, or edit the prompt and retry. With that setting, non-interactive runs end the turn with a refusal, because they cannot show the question.

The docs do not explain why this version says "session" where the older one says "message". They do list what to do next after a cybersecurity flag:

• If your work really needs this content, apply to the Cyber Verification Program (CVP). It gives access for legitimate cybersecurity work.
• If your request was not about a cybersecurity topic, run /feedback to report the false positive.
• To keep working in the same session, press Esc twice or run /rewind to step back to a checkpoint before the flagged turn. Then take a different approach.

The docs speak directly about security and biology work. Security research and biology workloads trigger fallback often, frequently on the first request. Anthropic's model configuration page says: "This is expected routing for these domains, not an account flag."

Why a flag can fire on your first message

The first request of a Claude Code session includes workspace context, such as your CLAUDE.md content and git status. Anthropic's docs say a repository that contains security or biology material "can trip the classifier on that context alone". That sentence is about fallback. It also explains why a flag can appear on a first prompt that looked harmless.

To check whether your customizations cause it, start a session in safe mode:

claude --safe-mode

Safe mode turns off customizations such as CLAUDE.md, skills, MCP (Model Context Protocol) servers and hooks. Git status and directory names are not customizations, so Claude Code still sends them. If the flag stops in safe mode, one of your customizations is the likely source. The guide to what Claude Code puts into its context window shows where each of those files enters the conversation.

"Can't help with this. Start a new session to continue"

This is the Usage Policy refusal in Claude Code. Anthropic's documented example names a different model, but the message has the same form:

API Error: Opus 4.6 can't help with this. Start a new session to continue.

Send feedback with /feedback or learn more: https://www.anthropic.com/legal/aup

The message names the model that declined, or Claude when no model is recorded. That is why you may see "Sonnet 5" in that place. Anthropic does not publish a separate Sonnet 5 example.

The docs say why the message tells you to start a new session. The check reads the full conversation, not only your latest prompt. Sending another message in the same session usually triggers the same refusal again. Reopening the session with --continue or --resume usually does too, because the transcript on disk still holds the content that triggered it.

Two details change what this message means for some readers. On Claude Code versions before v2.1.219, the same refusal read Claude Code is unable to respond to this request, which appears to violate our Usage Policy. A link followed, then a suggestion to edit your last message or start a new session. On Amazon Bedrock, Google Cloud's Agent Platform and Microsoft Foundry, this message also covers requests flagged as a cybersecurity topic. On those platforms, a cybersecurity flag shows this message instead of the "safeguards flagged" one.

The documented next steps are these:

• Press Esc twice or run /rewind to return to a checkpoint before the turn that triggered the refusal.
• If you cannot tell which turn caused it, run /clear to start a fresh conversation in the same project. The old conversation stays on disk and is still listed in /resume.
• In non-interactive mode (claude -p), rewind is not available. Start a new session without --continue.
• Anthropic adds that policy checks vary by model, so switching model with --model may solve the refusal in some cases.

After a rewind, Anthropic's own words are "rephrase or take a different approach". This page reads that as changing the task. It does not mean looking for words that get the same task through. If you believe the refusal is wrong, use the Request ID and Message ID in the message. Quote both to support. Anthropic gives support in writing, through the support messenger and email.

What the [reasoning_extraction] detail line means

Some refusal messages have an extra line: Details: [reasoning_extraction]. Both the "can't help with this" and the "safeguards flagged" messages can include it. It means the safeguards flagged the request as asking the model to reproduce its internal reasoning in the response. Claude Code added this line in v2.1.234, so older versions do not show it.

The fix is to remove or reword the instruction that asks for the reasoning. That instruction may be in a file you did not write today: CLAUDE.md, a skill, a subagent prompt, an output style or an MCP tool description. Test with claude --safe-mode, and start a new session after you change a customization. The Claude Code error page describes only this one tag. It does not describe other tags that people report online.

"Blocked under Anthropic's usage policy" is not an Anthropic message

We searched Anthropic's help center and documentation for We are unable to complete this request because it was blocked under Anthropic's usage policy. It does not appear on any of those pages. So Anthropic does not document which product shows it, or what it means for your session or account.

The closest documented responses are the Usage Policy refusal in Claude Code, described above, and a stop_reason of refusal on the Claude API, described below. If you see this sentence in a tool other than Claude Code or the Claude apps, ask that tool's support which response produced it. Give them any request ID that the message shows.

How the Claude API reports the same refusals

On the API (application programming interface), a classifier refusal is not an error. You get a normal response with stop_reason: "refusal". Anthropic documents this for Claude Fable 5.1, Fable 5, Opus 5.5, Opus 5, Sonnet 5.5 and Haiku 5.5. The stop_details.category field names the policy area:

• cyber: Anthropic notes that harmless cybersecurity work can also trigger it.
• bio: biological harm. Useful life sciences work can also trigger it.
• frontier_llm: help with building competing AI models.
• reasoning_extraction: a request to reproduce internal reasoning.
• general_harms: a usage policy area outside the named categories.
• null: the refusal does not match a named category. This is a normal, permanent value.

A refusal can arrive before any output, or partway through the streamed output. Treat any partial output as incomplete. Because a refusal is not an error, monitoring that only counts errors will not see it. Check stop_reason instead.

The API docs give the next step plainly: "you must reset the conversation context before continuing." You can remove or change the turn that triggered the refusal, or clear the history. If you continue without a reset, you get more refusals. If you send a refused request to the same model again, it usually refuses again. Sending it to a different Claude model is a documented option, and the API has a server-side fallback option, in beta, for that.

Some refusals cost money. A refusal before any output is billed when its category is bio, frontier_llm or reasoning_extraction. Anthropic says these are the categories with low measured false positives "as of September 2026", and that the list may change. Refusals before output in the other categories, or with a null category, are not billed. A refusal partway through the output bills the input tokens and the output already streamed. Every refused request still counts against your rate limits, so keep this in mind when you read the Claude API rate limit headers.

What the Claude apps show instead

On claude.ai and the other Claude apps, Anthropic describes a model switch, not an error message. The support article for Opus 5 and Opus 5.5 says a blocked request runs again on a less capable model in the same conversation, with a notice that the model switched. After the switch, "the model picker stays on the less capable model for the rest of the conversation." You can switch back from the model picker. The same safeguards may trigger again while the original request is still in the conversation. The article does not quote the notice text, so we cannot confirm that it matches the Claude Code text.

The Sonnet 5.5 article says cybersecurity and frontier LLM (large language model) development flags fall back to Sonnet 5. Biology and distillation requests are blocked outright. "With automatic model switching off, a request that falls back pauses the chat instead of switching models." Both articles point to Send feedback for blocks that look wrong. The Opus article also points to the Cyber Verification Program for legitimate defensive cybersecurity work. Neither article describes any effect on your account.

Does a flagged session affect your Claude account?

Keep two things apart. A refusal acts on one request or one conversation. An account action, such as a warning or a ban, applies to the account itself. Anthropic describes them on different pages.

The Claude Code error reference, the model configuration page and the two model-switching articles all say the flag applies to the request or the conversation. None of them mentions an account penalty. Anthropic's pages for these messages do not say that a flag affects your account. That is not the same as a promise that a flag never can.

Account actions are covered in Anthropic's safeguards warnings and appeals article. It says Anthropic warns users "if we believe their prompts are violating our Usage Policy". For API customers, "these warnings are linked to ongoing thresholds of violative behavior across their entire API account." It gives these reasons for a ban: repeated violations of the Usage Policy, account creation from an unsupported location, and Terms of Service violations. A separate Anthropic article on user safety adds: "We may temporarily apply enhanced safety filters to users who repeatedly violate our policies." None of these pages links an account action to any of the messages in this guide.

The Cyber Verification Program is the documented route when legitimate security work keeps getting flagged. Anthropic's article says it covers Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1, plus new models. You apply through the Verification Portal, and Anthropic aims to send a decision "within seven business days". Approval alone does not turn the access on. You assign it to a workspace, role or linked cloud account. Anthropic says no action is needed on Team, Max and Pro plans, where the program applies at the organization level. Anthropic also says: "We may review, narrow, or withdraw a grant."

If your account was banned or suspended

A ban is not a refusal, so the steps above do not apply. The appeals article gives this route. Go to claude.ai, log in with the banned account, and fill out the appeal form behind the Submit an appeal link. You must be logged in to reach the form.

If your Free, Pro, Max or Ultra account was banned for violating the Usage Policy, you can still log in to export your data or delete your account. Anthropic notes that it may limit the data you can export, depending on the violation. To dispute a warning instead of a ban, email the Safeguards address given in the same article, with your situation and your account details. If an organization you belong to was paused for unusual activity, the restricted account screen lists it. Click Request a review to ask the Safeguards team to look again.

On 8 November 2026 the article said response times "are currently longer than normal". One page does not help here. Anthropic's "Exceptions to our Usage Policy" article is about contracts with government customers. It is not a route for a refusal you think is a false positive.

If you are new to the tool itself, what Claude Code is and how it runs explains the sessions and slash commands this guide refers to.

FAQ

Does "safeguards flagged this session" mean my Claude account is banned?

No Anthropic page for this message describes an account action. The Claude Code docs treat it as a cybersecurity flag on a request. For security and biology work, they call fallback "expected routing for these domains, not an account flag." A ban is a separate action, described in Anthropic's safeguards warnings and appeals article. If you cannot log in, read that article. To reach the appeal form, log in at claude.ai with the banned account.

Why does Claude Code say "Start a new session to continue"?

The Usage Policy check reads the full conversation, not only your last prompt. Sending another message in the same session usually triggers the same refusal again. Reopening the session with --continue or --resume usually does too, because the saved transcript still holds the content. Press Esc twice or run /rewind to go back before the flagged turn, or run /clear for a fresh conversation in the same project.

Who shows "blocked under Anthropic's usage policy"?

Anthropic does not document this sentence on any of its help or documentation sites. If you see it in a third-party tool, ask that tool's support which response produced it, and give them the request ID if the message shows one. The closest documented responses are Claude Code's Usage Policy refusal and a stop_reason of refusal on the Claude API.

How do I report a Claude refusal I think is wrong?

In Claude Code, run /feedback. The Usage Policy refusal also has a Request ID and a Message ID to quote to Anthropic support, which answers in writing through the support messenger and email. In the Claude apps, use Send feedback. If legitimate cybersecurity work keeps getting flagged, apply to the Cyber Verification Program.

Does a refused API request cost money?

Sometimes. A refusal that arrives before any output is billed when its category is bio, frontier_llm or reasoning_extraction. It is not billed for cyber, general_harms or a null category. A refusal partway through the output bills the input tokens and the output already streamed. Every refused request counts against your rate limits either way.