Anthropic's Claude Code documentation says Fable models, Opus 5.5, Sonnet 5.5 and Opus 5 run with safety classifiers, which most often flag cybersecurity and biology content. When a request is flagged, Claude Code can re-run it on a different model. This is why a session can end up on another model without you choosing one.

Which model you end up on

According to the Model configuration page, the fallback depends on the model that refused and the kind of flag.

  • Fable 5.1, Fable 5 and Opus 5.5: biology-flagged requests re-run on Opus 5, and cybersecurity-flagged requests re-run on Opus 4.8.
  • Sonnet 5.5: cybersecurity-flagged requests re-run on Sonnet 5. Biology-flagged requests end with a refusal.
  • Opus 5: cybersecurity-flagged requests re-run on Opus 4.8. Biology-flagged requests end with a refusal.

The docs say Claude Code shows a notice in the transcript when it switches. After a fallback, the session continues on the fallback model. To go back, you run /model. If your availableModels setting blocks the fallback model, no fallback happens and the refusal is shown as a normal error.

The docs also note that a flag can come on the very first request of a session. That request carries workspace context such as CLAUDE.md and git status, so a repository with security or biology material can trigger the classifier on its own. Anthropic suggests starting a session with claude --safe-mode to check whether customizations are the cause. Git status and directory names are still sent in that mode.

What changed recently

The Claude Code CHANGELOG lists several recent changes to how flagged messages are handled. Version 2.1.284, released September 28, changed the notice shown when a Sonnet model's safeguards flag a message so that it explains why it happened and offers editing and retrying. The same version changed sessions that pin an Opus model with ANTHROPIC_DEFAULT_OPUS_MODEL or modelOverrides, so that on the Anthropic API the API picks the model to switch to for each kind of flag instead of the pinned model. Version 2.1.287, released October 1, made automatic model switches after a flagged message keep your current effort level instead of the new model's default. Version 2.1.290, released October 5, fixed the effort level changing when a flagged message is retried on a fallback model that has a different level saved in settings. Version 2.1.300, released October 14, fixed "Edit prompt" on a flagged message in VS Code opening the file or command menu over the restored prompt.

How to make Claude Code ask first

Anthropic's Settings reference describes switchModelsOnFlag. It appears in /config as "Switch models when a message is flagged", with the options "Switch automatically" and "Ask each time".

  • Set to true, Claude Code switches to the fallback model and continues.
  • Set to false, an interactive session pauses so you can choose between switching and editing the prompt. Where no dialog can show, such as a -p run, the flagged request ends as an error.
  • Left unset, Claude Code switches automatically, though it may ask first in an interactive session. If it asks and you answer, your choice is saved as this setting in your user settings.

What users report in GitHub issues

Several open issues in the anthropics/claude-code repository say the setting doesn't always work, or describe flags on ordinary work. These are users' own reports.

  • Issue 103106, opened October 18 by jlumbroso: with switchModelsOnFlag set to false in the project settings, a session on claude-fable-5 was switched to claude-opus-4-8 on October 14 without any action from the user.
  • Issue 98875, opened October 2 by ttmdxb: while managing their company's office PCs, the reporter says Fable 5.1 repeatedly flagged turns as cyber. They say one session ran 255 consecutive messages on Opus 4.8, the setting was ignored, and the interface gave no sign the model had changed.
  • Issue 98387, opened September 30 by axiomie: with the setting set to false, a subagent started by the Agent tool continued on claude-opus-4-8 after refusals.
  • Issue 95500, opened September 19 by cafe24-yyoh: with the setting set to false, the reporter says Fable 5 flagged children's song lyrics and routine Korean e-commerce instructions, leaving the session unusable with Fable 5.
  • Issue 91209, opened September 1 by sayantan-work: the reporter says local troubleshooting, such as reading a LaunchAgent plist file, was flagged as cyber 15 times since August 3, pinning whole sessions to Opus 4.8.

When we checked these issues, none had a reply from Anthropic.