best part is, if you actually know what you're doing, you cna absolutely get it to find bugs/vulns/etc. so it just really about preventing long horizon agentic tasks or people who don't know what they're doing or those who are doing legit non-offensive security sfuff

I've learned some of the incantations to get it to find things without being blocked (as often) but I am paying for the product and in my opinion the product has been rendered incomplete and unreliable. I am not going to play games with them or have to hire the NCC Group to find the bugs that Claude is perfectly capable of finding.

yeah, what I meant with my comment is that the guardrails are supposed to stop honest people, since those that know how to bypass them will have ways to do so

So far Opus hasn't complained about doing security reviews of my code. Though I never asked it to exploit the vulnerabilities or to produce a PoC.

Thing is that it does it silently, I only noticed this because randomly opencode summaries were something like sorry I can’t summarise this.

I’ve seen 2 hard guardrails with Opus 5.5 (even on a corporate account that’s not supposed to have these kinds of false positives). one, as you mentioned, is asking it to produce a PoC. but the other (which I’ve hit too many times for it to be a coincidence) is looking at a kernelspace vulnerability area even without PoC-ing.

Somewhere along the line someone at Anthropic decided you can attack userspace all day but you cross that line and it’s a problem.