Claude Opus 5.5 hands some AI training work to Opus 5. What triggers it, and what to do

What happened on October 31

At 5:22 a.m. Central on October 31, 2026, the researcher Jiahao Shao posted on X that Anthropic had flagged their work:

I never distilled Claude—rollouts came from a strong open-source model; Claude just helped submit jobs and run analysis. Still got tagged for “training a competitor,” and now anything touching RFT, SFT, or training larger models gets me blocked, Opus 5.5 downgraded to Opus 5, or the session killed outright.

RFT and SFT are reinforcement and supervised fine-tuning, two common ways to train a model further. The post drew more than 2,000 likes, and a Hacker News thread about it reached the front page the same day as “Anthropic blocks users for anything touching training larger models.”

That headline goes further than the post. Shao describes requests being blocked or handed to an older model, not a closed account. Anthropic hasn’t commented on the case, and SquaredTech, which covered it, notes that it has only Shao’s side.

The downgrade Shao describes is one Anthropic documents. It has been part of Opus 5.5 since the model launched on September 22.

What the safeguard covers

At launch, Anthropic’s developer account wrote that “Opus 5.5 is the first Opus with Fable 5.1-class safeguards on cyber, bio, and frontier LLM development,” and that “Flagged requests fall back to another model.” The launch post says that in its benchmark runs, when the safeguards intervened, “biology and frontier LLM development tasks were completed by Claude Opus 5.”

Anthropic’s help article on model switching describes the frontier LLM classifier:

Opus 5.5 has classifiers similar to Fable models for a small set of capabilities related to the development of frontier LLMs, such as kernel development for certain ML accelerators. They shouldn’t impact the vast majority of traditional AI or ML development, research, or general coding. These classifiers cause Claude to fall back from Opus 5.5 to Opus 5.

Its article for Fable models gives more examples of the same category: “distributed training infrastructure, ML accelerator design, and kernel development for certain non-standard chips.” The API documentation is plainest about its purpose. A refusal in the frontier_llm category means “The request could help with the development of competing AI models, which is restricted under Anthropic’s commercial terms. Benign machine learning work can also trigger this category.”

These are the four classifiers on Opus 5.5:

Classifier	What it looks for, in Anthropic’s words	What happens on Opus 5.5	Billed if refused before any output
Cybersecurity	“potentially higher-risk offensive cybersecurity requests”	Re-runs on Opus 4.8	No
Biology	“dual-use requests in areas like virology, toxicology, and molecular design”	Re-runs on Opus 5	Yes
Frontier LLM development	“a small set of capabilities related to the development of frontier LLMs”	Re-runs on Opus 5	Yes
Distillation	“attempts to extract the model’s internal reasoning”	Blocked outright, with no fallback	Yes

Three details matter for anyone doing ML work:

• It reads more than your message. The checks “review everything the model reads, not just your latest message,” including memory, connectors, web results and files, “so a fallback can be triggered by content you didn’t type.” A repository full of training code can count.
• It sticks. After a switch, “the model picker stays on the less capable model for the rest of the conversation,” and switching back “may cause Claude to fall back again if your original request is still part of the conversation.”
• Your account counts. Anthropic says it is tuning the classifiers by “factoring in a range of account trust signals.”

Opus 5 doesn’t run this classifier: “Opus 5 doesn’t fall back on frontier LLM development questions.”

What the terms say

The rule behind it is in Anthropic’s terms. The Consumer Terms, which cover Claude.ai, Claude Pro and Anthropic’s other services for individuals, bar using them “To develop any products or services that compete with our Services, including to develop or train any artificial intelligence or machine learning algorithms or models or resell the Services.” The Commercial Terms, for API keys and the Console, bar using the services “to build a competing product or service, including to train competing AI models or resell the Services except as expressly approved by Anthropic.”

Anthropic isn’t alone in this. OpenAI’s terms of use, in effect since January 1, 2026, say you may not “Use Output to develop models that compete with OpenAI.”

Neither Anthropic page defines “compete.” Nor has Anthropic said where Shao’s kind of work falls: using Claude to run and analyze training jobs on data from another model.

What other people report

Shao isn’t the first to say the classifier caught ordinary work. In Claude Code’s issue tracker:

• On October 15, an AI infrastructure engineer reported that Opus 5.5 “frequently triggers frontier_llm warnings” on routine tasks, such as “Maintaining open-source frameworks like Megatron” and “Learning open-source AI infrastructure concepts,” and even when “Simply inquiring why my Opus 5.5 is currently unavailable.”
• On October 3, another user wrote: “My Claude Code account can no longer use Claude Opus 5.5, including in any newly created sessions. The error reports Details: [frontier_llm].” They describe their work as “legitimate software development and general coding.”

Others haven’t hit it. In the Hacker News thread, one commenter wrote that they were using Claude “to train models with a novel linear flash attention mechanism right now. No refusals,” and another that they had used it “to train a few BERT models.”

It started with Fable 5

The category isn’t new, and the visible fallback was a correction. When Fable 5 launched in June, its system card said its frontier LLM safeguards “will not be visible to the user” and would “limit effectiveness through methods such as prompt modification, steering vectors, or parameter-efficient fine-tuning (PEFT),” Gizmodo reported on June 11. Anthropic then told Wired: “We’re changing Fable 5’s safeguards for frontier LLM development to make them visible,” and “We made the wrong tradeoff and we apologize for not getting the balance right.”

Today’s help article promises the visible kind: “All fallbacks are transparent, meaning you’ll see a notice explaining that the model switched, and the response will be labeled with the model that answered.” One exception is documented. In a Claude Code subagent, a flagged request “re-runs on the fallback model” without asking, and a user reported in September that a subagent’s switch left no notice at all.

What Anthropic hasn’t said

• Anything about Shao’s case. As of October 31, its newsroom and release notes don’t address it.
• The full list. It gives examples of what the frontier LLM classifier looks for, not a list, and no false-positive rate for it. It says only that biology, distillation and frontier LLM development are “the categories where our false positive rates are lowest, as of September 2026.”
• Whether a flag follows your account. Claude Code’s docs call fallbacks in security and biology work “expected routing for these domains, not an account flag.” They say nothing like that about frontier LLM development, and the October 3 report describes a block on every new session.
• A way in for ML researchers. Security work has the Cyber Verification Program and biology the Life Sciences Verification Program. The help article names no program for frontier LLM development.
• Bans. Anthropic says it bans accounts for “repeated and persistent attempts at distillation,” meaning attempts to extract Claude’s reasoning, and has banned “tens of thousands of accounts.” It hasn’t said whether frontier LLM flags lead to anything beyond the fallback.

What to do if it flags your work

1. Check which classifier it was. Claude shows a notice and labels the answer with the model that gave it. On the API, a refusal comes back as a normal response with stop_reason: "refusal", and its stop_details.category is "frontier_llm" for this one.
2. Ask to be asked. In the Claude apps, go to Settings > Capabilities and turn off Switch models when a message is flagged. In Claude Code, run /config and choose Ask each time, or set "switchModelsOnFlag": false in your settings. A flagged request then pauses, and you choose between editing it and sending it to the other model.
3. Edit, or start fresh. The flagged request stays in the conversation and can trigger the fallback again, so, in Anthropic’s words, “Editing your previous message before retrying often helps.” A new conversation leaves it behind.
4. Find what tripped it. The check reads your files and instructions too. In Claude Code, claude --safe-mode starts a session without CLAUDE.md, skills, MCP servers and hooks; if the flag goes away, one of them set it off.
5. Report it. Anthropic asks to hear about requests that seem “unrelated to one of the classifiers”: use Send feedback in the apps, or /feedback in Claude Code, and keep a note of the date and the model.
6. Mind the bill. Refusals before any output are billed in this category, and the fallback’s answer is billed “at the responding model’s rates.”

When a step keeps getting flagged

Some ML work will keep tripping the classifier, and Opus 5, which doesn’t run it, is Anthropic’s own answer for that step. Another lab’s agent follows that lab’s terms instead, and OpenAI’s draw a similar line in writing. An open model you run yourself answers to its license, with no lab’s classifier in front of it.

Enjoy runs Claude Code beside Codex and the other labs’ agents, each on your own plan, and local models through OpenCode. When Claude flags a step, you can switch the conversation to another agent, and it gets the messages it missed. Enjoy doesn’t change any lab’s rules: Anthropic’s terms still apply to what you do with Claude, whichever app runs it.

We’ll update this memo if Anthropic answers Shao or changes the safeguard.