{"resourceId":"capitalandcompute-claude-cyber-classifier-reverse-engineering-explainer-20261102","versions":[{"version":"external-ef0eba798f556276c5ad8eee75f8a6d5698ca1634efbe01d2942b2c607000a7a","resource":{"id":"capitalandcompute-claude-cyber-classifier-reverse-engineering-explainer-20261102","title":"Analysis: Claude reverse-engineering blocks come from an external cyber classifier with no off switch; Anthropic's own benchmark shows Defense Access still blocked 46 of 50 scenarios","organization":"Capital and Compute (independent analysis of Anthropic controls)","sector":"AI model provider; security practitioners","geography":"Global","publishedAt":"October 25, 2026 (updated November 3, 2026 UTC)","publicationDate":"2026-10-25","eventDate":null,"sourceName":"Capital and Compute","sourceLabel":"Independent analysis blog","sourceUrl":"https://capitalandcompute.net/blog/why-is-claude-blocking-reverse-engineering/","evidenceClass":"independent-research","outcomeClass":"cautionary","topics":["data-security","developers-agents","governance-procurement"],"finding":"This independent analysis argues reverse-engineering blocks come from Anthropic's cyber safety classifier, a separate system that ends the turn, not from a weaker model. It cites Anthropic's Oct. 6 statement that generally available models have conservative safeguards that block most cyber work. It reproduces Anthropic's CyScenarioBench table: without verification every trial was blocked on the first prompt, Defense Access was blocked in 46 of 50 trials at some point, and Red Team Access completed 34 of 50. It says there is no setting to switch the classifier off. The route is the Cyber Verification Program, and Anthropic aims to respond within seven business days.","sledRelevance":"Cross-tagged to state-government for state and local SOCs and campus security teams. It explains why rewording does not help and quantifies, from vendor data, how much verified defensive access still gets blocked on offensive-style scenarios. Why now: updated the evening of Nov. 2 CT as refusal reports spread, and it was not previously archived.","evidence":"Vendor benchmark figures (50 trials per tier) reproduced from Anthropic; user reports; no independent test.","architectureImplications":"Classifier reads all conversation content, including tool results from MCP servers, so local analysis tools still feed the gate.","governanceImplications":"Verification tiers become a governance decision with organization-level applications and seat assignment.","securityPrivacyImplications":"Classifier reads tool outputs as well as prompts; disguising tasks is a usage-policy violation.","caveats":"Independent blog; benchmark is offensive and vendor-run; refusal threshold changes unconfirmed.","streamIds":["anthropic","state-government"],"roles":{"sales":"The sales framing is that Claude's cyber gate is deliberate and has no off switch. This analysis, citing Anthropic, says generally available models block most cyber work, and even the Defense Access tier was blocked in 46 of 50 offensive-style benchmark trials. For state and campus security buyers, the honest offer is help with verification and with matching tasks to what is allowed by default, such as secure code review and alert triage. Do not suggest workarounds.","engineering":"The engineering view is that an external classifier reads the whole conversation, including MCP tool output, and ends the turn on offensive-looking work. Allowed defaults include secure code review, threat modeling, patching and alert triage. Malware analysis and exploit validation may be interrupted. Design security workflows around the allowed list, apply for the right verification tier at the organization level, and test the agency's real tasks, since the vendor benchmark is offensive-scenario based.","delivery":"The delivery view is access planning. The organization admin should decide whether Defense or Red Team Access is needed, apply once through the portal, and assign seats, allowing about seven business days. Map analyst tasks to the default allowed list and document fallbacks for the rest. Communicate that rewording is not a workaround and can violate the usage policy. Re-test after Anthropic changes classifier thresholds."},"roleDetails":{"sales":{"customerProblem":"Security teams need to know which defensive tasks Claude will perform and how to get access for the rest.","stakeholders":["CISO","SOC lead","Security research faculty"],"discoveryQuestions":["Which tasks fall outside the default allowed list?","Who is the organization admin for verification?","Is a paid plan in place for Defense Access?"],"valueHypothesis":"Interpretation: aligning workflows to allowed tasks and verification tiers reduces wasted analyst time.","potentialEngagement":"A task-mapping session and verification application support.","unsupportedClaims":["That verification guarantees completion","That any setting disables the classifier","Independent benchmark results"]},"engineering":{"fit":"Fits security teams using Claude for code review and triage; weak fit for unverified malware analysis.","architectureIntegration":"Classifier sits outside the model and reads prompts, files, connectors and MCP tool outputs.","prerequisites":["Organization-level verification","Paid plan for individual Defense Access","Task inventory"],"constraints":["No off switch","Defense tier still frequently blocked on offensive scenarios","Threshold changes undisclosed"],"security":"Classifier inspection of all context; disguising tasks violates usage policy.","proofOfValue":["Test real defensive tasks per tier","Track blocks per task type","Confirm verification response time"]},"delivery":{"work":"Plan verification tier, map tasks, and document fallbacks.","dependencies":["Organization admin","Anthropic verification portal","SOC"],"ownership":"CISO with the AI platform admin","skillsAdoption":"Analysts learn allowed tasks and the appeal route.","governanceCheckpoints":["Tier decision recorded","Retest after vendor changes"],"acceptanceCriteria":["Proposal: task map covering all SOC Claude uses","Proposal: verification decision within one review cycle"],"risks":["Over-reliance on blocked capabilities","Policy violations from rewording attempts"]}},"retrievedAt":"2026-11-03T04:02:06Z","enrichedAt":"2026-11-03T04:05:23Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Security staff need training on which tasks are allowed by default.","procurementImplications":"Budget time for verification review and paid-plan requirements.","operatingModelImplications":"Organization admins, not individuals, should apply and assign seats.","sourceVerification":{"openedUrl":"https://capitalandcompute.net/blog/why-is-claude-blocking-reverse-engineering/","referenceExcerpt":"There is no setting to switch the classifier off.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}