The Ceiling

Taxonomy first, prompt-craft second. A policy refusal means the request crossed the Usage Policy or a classifier decided it probably did. A capability refusal means Claude has no tool, file, credential, or current source to work from. An uncertainty refusal means Claude declined to invent something. A product refusal comes from the surface around the model. A fallback is not a refusal at all: it is a different model answering. Only the first responds to the kind of rewriting people reach for.

The API is the only place where part of this is legible. Claude docs define refusal as a distinct stop reason alongside max_tokens, pause_turn, and tool use, so a developer can tell a declined request from a truncated one without guessing. In the chat products you get prose, and prose from a policy refusal reads much like prose from an uncertainty refusal.

People treat a refusal as a moral event about the prompt. Most of the time it is a routing event about the stack. The Usage Policy is public; the classifier sitting beside the model is not; the product around both can decline for reasons that have nothing to do with either. Asking which layer said no is the only question that makes a rewrite useful, and four of the five answers will tell you not to rewrite.

A classifier false positive is a refusal the model itself would not have produced. Three layers can decline a request and only the middle one counts: the trained model, a classifier running beside it, and the product wrapped around both. The tell is portability. If the identical request succeeds on another Claude model or another surface, the boundary was probably not the model’s judgment about your request.

The measurement tooling has the same problem it measures. In Anthropic’s own public red-team demo, the automated grader refused to grade roughly 1% of submissions overall and about 10% on one question. That is a useful humility check before treating any single classifier output as ground truth, including the one that just fired on your work.

Every figure in this room is dated, and that is the point of publishing them. The 0.38% increase belongs to February 2025. The 85% fewer cyber interventions belongs to the Opus 5 launch in July 2026. Neither is a current production overrefusal rate, and Anthropic has not published one. Anyone quoting a single percentage as “how often Claude overrefuses” is citing a lab snapshot as if it were a live meter.

Before 2026 a flagged request announced itself. You got a refusal, and the boundary was visible even when it was wrong. Since the Opus 5 launch in July 2026, flagged requests on Claude.ai, Claude Code, and Claude Cowork fall back to Opus 4.8 by default, framed in the announcement as routing to the best available model rather than being blocked.

The honest accounting is that this is a usability gain and an observability regression. A user who receives a quietly weaker answer cannot distinguish a safeguard intervention from the model having an off day. Anthropic’s own benchmark footnotes record the same dynamic: Opus 4.8 served as the fallback on safety-classifier refusals inside published Opus 5 and Fable 5 evaluation runs. If fallback traffic can appear in their numbers, it can appear in yours.

If you are measuring Claude.ai, Claude Code, or Cowork quality, the first column in the log is the model that answered. Without it, a classifier false positive, a context-decay failure, and an ordinary off day are indistinguishable. The API is the only surface where fallback is opt-in; everywhere else, the quieter model is the default when a classifier fires.

The most expensive misunderstanding on this floor is the word memory. A context window is an intake limit on a single stateless request. Every turn of a conversation ships the entire prior conversation back to the model along with the system prompt, tool definitions, images, and attached files. What feels like remembering is re-reading, paid for again on every turn.

The measured version of this comes from an unexpected place. In Anthropic’s eval-incident assessment, a scope reminder placed as the most recent thing in context stopped an unwanted behavior 90% of the time; the same reminder three turns earlier worked 40% of the time. That is the clearest published figure on this site for why position beats presence. An instruction that is merely somewhere in the window is not a live instruction.

The billing follows the architecture. Because the entire history is re-sent, a long conversation gets more expensive even when the new question is short. Compaction, memory features, and files like CLAUDE.md exist because the window is not a filing cabinet. Technique for living inside that constraint belongs to Claude Context; this room only records that the advertised ceiling is intake, not recall.

Prompt injection is the one limitation in this building that gets worse as the product gets better. Every capability that lets Claude read something you did not write, whether a browser tab, an email, a PDF, a repository, or a connector, is another channel through which a stranger can address the model. Anthropic’s computer-use documentation says plainly that Claude will follow commands found in content even when they conflict with the user’s instructions.

The defensive posture is boring and it works. Treat everything retrieved as untrusted input, give the agent the smallest tool set that finishes the task, and put a human gate in front of anything that spends, sends, deletes, or publishes. The failure to design against is not Claude being fooled once. It is Claude being fooled while holding credentials.

Claude in Chrome is generally available on paid plans, with a safety classifier on autonomous browser actions. That is progress, and it is the same pattern as every other classifier in this building: a mitigation that still fires, still misses, and still has to sit in front of irreversible actions rather than replace them. The incident room records what this failure looks like when the run is long and the environment is less isolated than advertised.

The mechanism sets the ceiling. Watermarking changes only where the randomness comes from when the model picks between equally good next words, deriving it from a key and the preceding text. Nothing is added, there are no hidden characters, and no extra tokens are produced. The signal can therefore only live in choices that were genuinely free, and that single constraint explains every gap: short text, factual text, code, and light editing all starve it.

Two further boundaries belong in the same breath. Watermarking applies to future Claude models, and models launched before August 2, 2026 sit inside an EU transition period. Separately, the C2PA content credential attached to generated files is metadata rather than a watermark; nothing is embedded, and stripping the metadata removes it. For the everyday version of this question, Claude Helps owns the how-to. Writer ethics live at Claude Writes. This room covers only where the evidence runs out.

The detection API is in private preview, which means most public accusations are not watermark checks at all. They are stylistic classifiers with no key, sold as if they were the same instrument. Conflating those two is how a weak guess borrows a cryptographic reputation. Until detection is public, a confident “this is Claude” claim from a third-party tool is not a watermark result, no matter how the vendor labels the button.

The numbers that generalize are not the incident counts. When separate model instances were shown each tool output from one incident in isolation, they judged 79% of those outputs as coming from real systems. Inside the live transcript, the model described the same evidence as simulated 72% of the time. The capability to read the evidence correctly was present, and the context suppressed it.

Anthropic has signed an agreement with METR for an independent investigation, with access to transcripts beyond the incident window and to employees permitted to share confidential information. External review at that depth is a stronger accountability signal than a self-published post, and whether METR’s conclusions match Anthropic’s is the thing to watch. Our freshness log records it when it lands.

This room has a hard stop on methods. Anthropic released transcripts of the evaluations; we link them and we do not retell the attacks. The usable residue is the evaluation lesson: pre-release auditing missed the severity, monitors that read the model’s reasoning inherited its bias, and a scope reminder that is not the most recent instruction is already decaying. Those are claims about how to read a lab, not a catalog of what the models did.

Two meanings of uncensored travel in Claude search traffic. One is legitimate: people want candid information about limits, refusals, and failures, which is the entire purpose of this building. The other is a request for bypass prompts, and it has no product behind it. Safety behavior is trained into the model and reinforced by classifiers on the platform, so there is no setting, tier, or API flag that removes it.

It is worth being precise about what the guardrails do and do not achieve, because the flattering half gets quoted alone. Anthropic’s bug-bounty round found no universal jailbreak. The public demo that followed did: across 339 red teamers and more than 300,000 chats, the system held for five days before one participant cleared all eight levels. These defenses raise the cost of an attack substantially and do not reduce it to zero, which is an argument for honest evaluation rather than for bypass shopping.

If what you wanted was the funny version of a refusal, that gallery is Claude Gone Wild. This building will not collect slapstick, and it will not publish a bypass. Uncensored, as a domain name, means the limits are stated in the open. It does not mean the model has a door behind the door.