"Opus 5.5's safeguards flagged this session [frontier_llm]": why a 你好 or a GRPO repo gets Claude moved to Opus 5, and why the refusal is billed

"Opus 5.5's safeguards flagged this session," Claude Code told Haojun Zhao, a former research engineer at Hugging Face, after he typed one word: 你好, "hello" in Chinese. The notice ended with Details: [frontier_llm] and offered two choices, switch to Opus 5 or edit the prompt and retry. His November 9 post of the screenshot has been viewed about 300,000 times, and it is the clearest public example yet of how Anthropic's frontier-LLM classifier behaves in practice.

The classifier itself isn't new or secret. Anthropic's API documentation lists frontier_llm as one of five refusal categories, defined as a request that "could help with the development of competing AI models, which is restricted under Anthropic's commercial terms," and adds: "Benign machine learning work can also trigger this category." The Help Center article on model switching says Opus 5.5 has these classifiers "for a small set of capabilities related to the development of frontier LLMs, such as kernel development for certain ML accelerators," that they "shouldn't impact the vast majority of traditional AI or ML development, research, or general coding," and that when they fire, Claude falls back from Opus 5.5 to Opus 5. Opus 5 doesn't run this classifier.

Why "hello" can trip it

The same Help Center article explains how a greeting can be flagged. The checks "review everything the model reads, not just your latest message," including memory, connectors, web results and files, "so a fallback can be triggered by content you didn't type." In Claude Code that includes the project the session starts in. Zhao's screenshot shows a session opened in a dev directory; we can't see what was in it, so this is an inference, but the documented mechanism points at the context around the 你好, not the word.

That matches the reports in Claude Code's issue tracker. We searched anthropics/claude-code for frontier_llm and found 11 issues, eight of them opened since October 1:

• #108618 (November 9): a PhD researcher working on SFT and GRPO with small open-weights models says "every single session is immediately flagged" because the codebase contains terms like policy_loss, kl_penalty, rollout, vllm, verl and trl.
• #107042 (November 3): flags on the torch-spyre project, which the reporter describes as inference tooling, "not training".
• #105856 (October 29): a PhD student polishing an MLSys paper draft says a large share of requests have been flagged since October 28, and guesses that words like "CUDA", "GPU kernels" and "LLM training" are the cause.
• #102316 (October 15): an AI infrastructure engineer reports flags while maintaining Megatron, and even when "simply inquiring why my Opus 5.5 is currently unavailable." It was closed as completed the same day, with no public explanation.
• #99345 (October 3): a user says Opus 5.5 is unavailable in every new session, which reads more like an account-level state than a per-message flag.

Eleven issues is a small number, and self-reports are not a false-positive rate. But the pattern is consistent: ML vocabulary in files and prompts seems to matter more than what the user is asking for. It is also the pattern in Jiahao Shao's October 31 complaint that his account was tagged for "training a competitor" while Claude only submitted jobs and analyzed runs from an open-source model.

The part that costs money

The less visible detail is billing. Anthropic's refusals documentation says that "a refusal that arrives before any output is billed when its stop_details.category is "bio", "frontier_llm", or "reasoning_extraction"," to "disrupt attempts to circumvent Anthropic's safeguards at scale." Its stated reason for picking those three: "These are the categories where Anthropic measures low volumes of false positives, as of September 2026." Cyber and general-harms refusals before output are free.

So on the API, a false frontier_llm flag is a billed request that returns nothing, and if a fallback is configured, its answer is charged separately at the fallback model's rates (Anthropic credits the resulting cache miss). On a Claude subscription the same rules apply to usage. And after a switch, Anthropic says the model picker "stays on the less capable model for the rest of the conversation," and switching back may trigger the fallback again while the flagged message is still in context. "Editing your previous message before retrying often helps," the Help Center says.

On the API, fallback is off until you configure it, and the refusal comes back as an HTTP 200 response with a refusal stop reason and stop_details.category: "frontier_llm", not as an error, so monitoring built only on error rates won't see it.

What you can change

You can stop the automatic switch: Settings > Capabilities in the Claude apps, or Config > MODEL & OUTPUT in Claude Code, has a "Switch models when a message is flagged" toggle. With it off, a flagged request pauses so you can edit it or send it to Opus 5 yourself. Anthropic asks users to report wrong blocks with "Send feedback", and says it is reducing false positives partly by "factoring in a range of account trust signals." Unlike cyber and biology, which have the Cyber Verification Program and the Life Sciences Verification Program, the Help Center lists no verification route for frontier-LLM flags.

What Anthropic hasn't published is the thing ML users most need: a list of what the classifier targets beyond "kernel development for certain ML accelerators," a false-positive rate for this category, or a statement on cases like Shao's. Anthropic's updated Usage Policy, which bars using outputs to train models without authorization, takes effect today, November 12. It doesn't define where routine fine-tuning research on open models ends and "competing AI models" begin either.