Your AI vendor can change the rule in the middle of the task: the case of Claude and reverse engineering

Since October 21, Claude users have been reporting that the tool starts analyzing a program and stops mid-answer when the subject is reverse engineering. Anthropic has not confirmed any change. This text separates what is documented from what is reported and shows why the useful question for a company does not depend on which explanation is true.

In 30 seconds

What happened

The starting point is two pieces that existed before the reports. The first is the launch of Claude Opus 5.5, on Sep 22, 2026. According to the launch coverage, Anthropic assesses the model as comparable to Mythos 5.1 in biology and cybersecurity and therefore applied safeguards similar to those of Fable 5.1: cybersecurity requests flagged as sensitive are mostly routed to the older model, Opus 4.8. The second is the Cyber Verification Program ("CVP"), expanded on Oct 6 to three access tiers, in which verified organizations run into fewer blocks.

The third piece is what happened next, and it comes from users. On Oct 21, a thread on r/Claude claimed that Anthropic had "killed" REA (Reverse Engineer Anything, an open project that connects coding agents to tools for analyzing compiled software). Other users described the same behavior: Claude starts researching the target and, mid-answer, reports that a security check interrupted the response and that it cannot produce the text again, even rewritten.

Timeline

What is known and what is not

The path of a request, in one picture

Executive view: risk, gain and decision

Risk

The rule is not yours. When a team uses AI to analyze software, a third party decides where the line sits between what the tool accepts and what it refuses. That third party can move the line without notice, and the effect shows up mid-task. This holds whether the change is deliberate or a filter that started firing more often. For those who depend on the tool, the result is the same.

Cost. There is no public estimate of losses for this case, and this text does not invent one. What can be described is the type of cost: analyst hours stalled, an audit or incident response deadline blown, rework to redo the analysis in another tool.

Who answers. Usually whoever signed the deadline with the customer or the regulator, not the model vendor. AI contracts tend to cover use, not results. [CONFIRM with legal, case by case]

Gain

Discovering the dependency before the cut costs little. All it takes is an inventory of which tasks use AI and a simple continuity rule. The gain is turning a risk that is a surprise today into a vendor management item, with an owner and a deadline.

Decision for the next 30 days

1. List the processes that use an AI model and, for each one, which model it is and who owns it.
2. Mark the ones that halt the work if the model refuses the task. These go on the critical vendors list.
3. For each one, define plan B: another model, another tool or a manual procedure, and test it once.
4. Keep 5 to 10 typical requests as a routine test and run them periodically. If the result changes, you notice before the customer does. (My recommendation, not a practice cited by the sources.)
5. If the team does offensive security work or malware analysis, evaluate the verified-access program, knowing the cost: identification and data retention.

Commercial application: where there is revenue, savings, advantage or risk

• Security firms and consultancies. Those who sell software analysis, incident response or penetration testing have a product that depends on analysis tools. An interruption in the middle of a project becomes a late delivery and a contractual penalty. The verification program exists for this profile: the Defense Access tier covers incident investigation, malware analysis and vulnerability analysis and validation (Help Net Security).
• Studios and software owners. The same capability that worries those who depend on it worries those who are its target. On Oct 19, Kotaku reported that the studio Digital Sun changed the plans for its game's public playtest (the opening moved to around January) and said it was worried about news of games being reverse engineered. For those who build software, the ease of taking apart a finished product is an intellectual property risk.
• Brand and contract. If your service delivers results to the customer using a third party's AI, it is worth reading what the contract says about changes of model or rules. My opinion: dependency without an alternative is what turns the vendor's change into your problem.
• Savings. Concentrating everything on one vendor reduces integration and training costs. The case shows the hidden price of that saving: you pay with flexibility.

Operational view: processes, people and routines

• An owner per process. Each process that uses AI needs someone responsible for the decision to switch tools when something fails.
• Outage playbook. Write down, on one page, what the team does when the model refuses a task: who notifies whom, which alternative steps in and how quickly.
• Log of interruptions. Note when and how the tool interrupted. That history helps separate an isolated incident from a change in behavior and supports the conversation with the vendor.
• Culture. Guide the team not to try to “trick” the filter by disguising the request. Capital & Compute states that this usually does not work and may violate the vendor's terms of use; that is the author's reading, not Anthropic's text. [CONFIRM]
• Continuity. Delivery deadlines with slack for the possibility of switching tools mid-project.

Infrastructure view: models, integrations and dependencies

• Routing between models. According to the coverage, when the filter flags a cybersecurity request on Opus 5.5, the answer may come from Opus 4.8. A help page, cited by a community site, says each switch shows a notice and that responses indicate which model answered. This means the model you chose is not always the one that answers. [CONFIRM, since the help page was not read]
• Many tools, one door. When editors, agents and third-party tools call the same model, the cut hits all of them at once. Capital & Compute notes that the filter acts at the model provider, whatever tool sent the request.
• Local models as an alternative. The newsletter reports a test in which an open model with 27 billion parameters, running on a consumer graphics card, analyzed two programs offline. It is a single, unverified source and does not enter the conclusions. It serves as a signal: there is a plan B path that does not depend on the vendor, with limits on context and quality.
• Data and retention. The verification program requires Anthropic to retain session data to monitor abuse. Until the "Enterprise Frontier Safeguards" arrive, expected for fall 2026 with no date, the sources disagree on who can use the program with zero retention (see cross-check).

Security view: threats and controls

The underlying tension is real and has no simple solution. The same technique that shows what a TV does with your data also serves to break protections and find flaws that someone will sell. The model vendor has to draw a line without seeing the intent of the person asking. Any line displeases someone. This is a reading from the newsletter, and I agree with it.

Technology: how it works inside

A classifier is a program trained to give a text a score, for example "this request looks risky". In this case, it sits beside the AI model (description by Capital & Compute) and reads the conversation in real time. When the score passes a threshold, the system acts: it routes to another model or interrupts the response. Reports and users describe the cut as coming from the safety system, not from the model refusing on its own.

There is an unavoidable trade-off in setting that threshold. A low threshold blocks more attacks, but also blocks legitimate work (false positive). A high threshold lets more legitimate work through, but also more attacks (false negative). At the Opus 5.5 launch, Anthropic said it had temporarily applied a larger safety margin against attempts to get around the filter while it works to reduce false positives, according to the coverage (Unite.AI). My inference: if that margin was adjusted recently, it could explain the perceived difference from Oct 21. No source says so.

Why does the cut happen mid-answer? The press describes that it does, but does not explain why. My inference: the filter may evaluate the text as it is generated and stop when the whole passes the threshold. It is a working hypothesis, not documented information.

The verification program reduces blocks by tier. According to Help Net Security, in an internal Anthropic test with Opus 5.5 (CyScenarioBench, 50 attempts per tier), without verified access all 50 were blocked on the first request. On Defense Access, 46 were blocked at some point and 4 were completed. On Red Team Access, none were blocked and 34 were completed. This is a test of attack tasks, not of reverse engineering ordinary applications, and it does not measure what regular users encounter. [CONFIRM in Anthropic's original text]

For the general reader: what to do today

• If you use AI at work, note down which tasks depend on it. Ask yourself: what would I do if it refused?
• Do not try to trick the filter by disguising the request. Look for an official path or another tool.
• If you found a TV or device "listening too much", start with what is within your reach: review the permissions and privacy settings of the device itself.
• Be suspicious of headlines that claim "AI was banned from doing X". Check whether there is a statement from the vendor or only user reports.

Terms in this article

These terms should go into the channel's glossary. Until they are added, they are defined here.

Reverse engineering

Taking apart finished software or a device to understand how it works inside, without having the original design.

Classifier (safety filter)

A program that reads a text and decides whether it looks risky, and triggers an action such as blocking or redirecting.

False positive

Blocking something legitimate by mistake. In AI, a legitimate work request treated as a risk.

False negative

Something dangerous that the filter lets through.

Fallback model

An older or different model that answers when the main one should not.

Cyber Verification Program (CVP)

Anthropic's program that gives verified security professionals fewer blocks, in three tiers, in exchange for identification and data retention.

Data retention / zero retention (ZDR)

Whether or not the vendor stores the content of sessions. Zero retention means it does not.

Decompilation

Turning an already compiled program back into something a person can read. It is one of the steps of reverse engineering.

REA (Reverse Engineer Anything)

An open project that connects coding agents to tools for analyzing compiled software.

Open-weight model

An AI model whose file can be downloaded and run on your own equipment, without depending on a vendor for each answer.

Critical vendor

A vendor whose failure halts an important operation. It calls for a dependency map and a tested alternative.

Sources

Primary (could not be opened in this review)

• Anthropic, "Cyber Verification Program" (Oct 6, 2026): anthropic.com/news/cyber-verification-program. Cited by Help Net Security and Capital & Compute. [CONFIRM the text]
• Claude Help Center, "Cyber Verification Program": support.claude.com/en/articles/14604842-cyber-verification-program. Cited by Capital & Compute. [CONFIRM the text]

Journalistic and analysis

• Kotaku, Oct 24, 2026: Claude's Reverse Engineering Capabilities Used To Recompile Games May Have Been Quietly Nerfed
• Kotaku, Oct 19, 2026 (Digital Sun and the playtest delay): kotaku.com
• XDA Developers: Users report that Anthropic blocked Claude from reverse-engineering TVs
• tbreak: Claude Opus 5.5 users say reverse-engineering prompts now get cut off
• Help Net Security, Oct 7, 2026: Anthropic loosens Claude's cyber restrictions for verified defenders
• Capital & Compute: Why Is Claude Blocking Reverse Engineering? (analysis; it separates what is quoted from Anthropic from the author's inference)
• iamag.it: Claude Blocks REA? Reverse Engineering Stops Mid-Task
• Pasquale Pillitteri: Claude Opus 5.5 blocks smart TV reverse engineering, users report
• Opus 5.5 launch coverage (Sep 22): VKTR, Times of AI, TechJack, Cybersecurity360
• Three-tier verification program: TechJack
• Enlarged safety margin at the Opus 5.5 launch: Unite.AI

Community and newsletter

• r/Claude, Oct 21 thread ("Anthropic secretly killed the REA train"), cited by Kotaku. I did not read the thread directly.
• Madewithrea.com, community guide, updated Oct 24, unaffiliated with REA or Anthropic. Used only as an indication, without independent verification.
• The Atlas, GenAI Works newsletter, Oct 26, 2026 (origin of the topic; contains the single-source claims about the 27B local model).

Method note: pages read on Oct 26, 2026, partly through automatic summaries. The two Anthropic texts could not be opened; what is attributed to them comes from the sources above. I could not open Reddit or X directly.

Cross-check: where the sources differ

• A change or an old filter? The newsletter and some posts say Anthropic "killed" REA. Kotaku says "may have been". Capital & Compute argues it is the filter that already existed. Madewithrea says the same, without proof. The weaker formulation prevails: a report, unconfirmed.
• Interrupt or redirect? The launch coverage says cybersecurity requests go to Opus 4.8. Users describe an interruption. It may be the same mechanism seen in different ways or different mechanisms. No source clarifies it.
• Zero retention. Help Net Security says organizations already approved for Fable 5.1 or Mythos 5.1 with zero retention can use the program with zero retention as well. TechJack says accounts with zero retention are not eligible until the "Enterprise Frontier Safeguards". I could not resolve the divergence without the original text. [CONFIRM]
• Samsung TVs. XDA and Pasquale Pillitteri link the cut to the TV case. Kotaku thinks it unlikely to be the main reason. XDA describes its own account as an "unverified anecdote". It stays out of the conclusions.
• Single sources left out: the ban of a researcher by OpenAI (his own account, repeated by sites; the guidelines cited say a safety warning alone is not a violation), the figure of "400 partners" in advertising in the TV story, and the test of the 27B local model.

Final question

If your company's main AI model stopped accepting a task today, who would notice first, and how quickly? Reply by Instagram direct message to @techtraduzida and tell us how your team handles this point. If this content helped, follow the profile, like and share: it helps develop and spread the channel.