# Safety filters block legitimate coding tasks (`work.safety_refusals`)

Feedback Bench, coding agents, built 2026-10-19, window 2026-08-31 to 2026-10-18. Web page: https://feedbackbench.com/coding-agents/#/criterion/work.safety_refusals

Area: [Doing the work](https://feedbackbench.com/coding-agents/criteria/work.md)

**Definition.** Refusals or safety classifiers stop benign or security-remediation work.

**Boundary.** Not this: see [Tool approval prompts and autonomy modes](https://feedbackbench.com/coding-agents/criteria/work.permission_prompts.md) for tool approval prompts. Not this: see [Automatic model routing and fallback](https://feedbackbench.com/coding-agents/criteria/models.routing_auto.md) for safety-triggered model downgrades.

Rated user-weeks, all agents: 1074. Complaint share: 86%.

## The brief

Written by large language models from this page's numbers and the posts it quotes, then checked: every number in the text is in the build. Interpretation, not measurement.

OpenAI Codex and OpenCode are the best at not refusing legitimate work. Their users say these agents take on reverse engineering, decompiling and security research that other agents turn down. The criterion draws 1.3% of what users rate, and 85.6% of rated user-weeks complain. Claude Code is last, 5th of 5. Its users rate refusals 6.19 times as often as other users, and they write 59% of the category's complaints here. Cursor also ranks low.

### What separates the best from the rest

Users of the leading agents say the agent does the task. Codex users say it decompiles code and works on reverse engineering. Some users keep a Codex or OpenCode subscription for the tasks Claude refuses. Codex still draws complaints: it has 32% of the category's complaints here. Claude Code users describe refusals of small security tasks, of scraping, and of work on bio and life science software. Cursor users describe ordinary prompts that suddenly get blocked as sensitive or as against usage guidelines.

- **Ranks high**: [OpenCode](https://feedbackbench.com/coding-agents/agents/opencode.md), [OpenAI Codex](https://feedbackbench.com/coding-agents/agents/codex.md)
  - OpenAI Codex, 2026-10-09, r/ClaudeAI (Reddit): “yea codex happily decompiles whatever you want. it’s persistent at it too.” [source](https://www.reddit.com/r/ClaudeAI/comments/1x1q7jx/how_to_bypass_the_i_cannot_reverse_engineer_or/pevvk8n/)
  - OpenCode, 2026-10-12, r/vibecoding (Reddit): “opencode go for $10/month is perfect for me. glm 5.3-flash has near unlimited use and is happy to work on explicit security problems.” [source](https://www.reddit.com/r/vibecoding/comments/1x47vk1/which_ai_subscription_to_choose/pgd6m4o/)
- **Ranks low**: [Claude Code](https://feedbackbench.com/coding-agents/agents/claude-code.md), [Cursor](https://feedbackbench.com/coding-agents/agents/cursor.md)
  - Claude Code, 2026-10-18, r/ClaudeCode (Reddit): “i will try this for sure! even for personal projects i need to bend backwards to discuss license terms, intellectual property concerns, etc to get opus 5.5 to do stuff.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x93e5o/vibe_coding_tv_ui/phi1z28/)
  - Cursor, 2026-09-28, @cursor_ai (X): “this is @cursor_ai preventing me from thinking through bug fixes on my own code base because the prompt is "sensitive". things seem to be getting worse across the board [link]” [source](https://twitter.com/20165956/status/2104593426671173950)

## How it breaks

Rule: A separate pass sorts complaints into failure modes. For each criterion with at least 30 complaining user-weeks, a large language model reads 150 complaint posts drawn at random and names 4 to 8 failure modes; a second large language model then puts every complaint post on that criterion in one mode, or in Other when it fits none. Modes are fixed once named, and new posts are sorted into them each week. A mode counts distinct user-weeks with a complaint in it, per agent; across agents, one user-week per agent. Modes do not change the labels or the Feedback Score. Examples: up to 3 posts per mode from different users, chosen and checked as receipts are.

The largest failure mode is a cyber safeguard that trips on routine engineering work, often over one keyword or filename. It accounts for 21% of complaining user-weeks. Refused defensive security work and unexplained blocks follow at 18% each. Claude Code has the largest share of every mode except one, where it ties with OpenAI Codex. Two modes belong mostly to Claude Code: biosecurity blocks on benign science, at 89%, and sessions spoiled by earlier context, at 71%.

922 complaining user-weeks.

| Failure mode | User-weeks | Posts | Agents (user-weeks) | Definition |
|---|---|---|---|---|
| Cyber classifier trips on ordinary engineering work | 193 | 207 | Claude Code 107, OpenAI Codex 72, Google Antigravity 5, OpenCode 4, Cursor 3, Kiro 1, Pi 1 | A cybersecurity safeguard blocks or ends a session doing routine non-security work such as refactoring, devops, SSH to the user's own hosts, localhost testing, API mapping, loading skills or browsing, often because of a single keyword or filename; refusals of openly security-themed tasks are excluded. |
| Defensive security and reverse engineering refused | 168 | 183 | Claude Code 96, OpenAI Codex 57, Google Antigravity 8, Cursor 3, OpenCode 3, GitHub Copilot 1 | The agent refuses legitimate security work like hardening the user's own app, vulnerability triage, patch review, bug-bounty research or authorized firmware/RE work, even for users enrolled in trusted-access programs; refusals of plainly malicious requests such as keygens or piracy are excluded. |
| Opaque, inconsistent blocks with forced model downgrades | 163 | 174 | Claude Code 103, OpenAI Codex 43, Cursor 10, Google Antigravity 4, OpenCode 3 | Blocks come with no reason, vary between identical retries or days, quietly switch the user to an older or weaker model, or still count against usage, so users fall back on rewording and trial and error; complaints only about the refusal's substance are excluded. |
| User-authorized system or account actions refused | 83 | 89 | Claude Code 48, OpenAI Codex 28, Cursor 4, OpenCode 2, Google Antigravity 1 | The agent refuses actions the user explicitly authorizes on their own machine, repo, forms or accounts, such as changing system settings, pushing commits, ticking form checkboxes, placing trades or downloading licensed datasets, citing policy instead of a technical limit. |
| Accumulated context poisons the whole session | 65 | 77 | Claude Code 46, OpenAI Codex 16, Cursor 2, OpenCode 1 | Earlier context, memory, notes, project files or summarized thinking keep setting off the classifier on later harmless messages, so the session ends, can't be resumed, or the user has to scrub their context; one-off blocks of a single prompt are excluded. |
| Harmless prompts flagged as inappropriate content | 60 | 65 | Claude Code 26, OpenAI Codex 26, Google Antigravity 5, Cursor 2, OpenCode 1 | Ordinary coding or creative instructions, like styling text, generating screenplay stills or mild profanity, get blocked as sexual, violent or otherwise against community standards; cyber and bio-related blocks are excluded. |
| Biology and science topics trigger biosecurity blocks | 44 | 47 | Claude Code 39, OpenAI Codex 2, Cursor 2, OpenCode 1 | Benign scientific work involving DNA, species data, papers, lab protocols or historical texts is refused or downgraded by biosecurity filters; non-science content-policy refusals are excluded. |
| Credentials and test data handling refused | 33 | 36 | Claude Code 22, OpenAI Codex 11 | The agent won't enter, hardcode or script passwords, API keys, test cards or staging credentials for the user's own dev environment even with explicit permission; leaks of real secrets by the agent are excluded. |
| Other | 156 | 166 | Claude Code 83, OpenAI Codex 51, OpenCode 9, Google Antigravity 5, Cursor 5, Cline 1, GitHub Copilot 1, Pi 1 | Complaints that fit none of the modes above. |

#### Cyber classifier trips on ordinary engineering work

- Claude Code, 2026-10-17, r/ClaudeCode (Reddit): “cyber security related very small things which are going to 'refused to work' by claude with every model” [source](https://www.reddit.com/r/ClaudeCode/comments/1x8cmyg/what_are_official_or_legal_ways_to_do_these/phbglkt/)
- OpenAI Codex, 2026-10-16, X search: OpenAI Codex, Codex CLI, Codex app (X): “both my @openai codex sessions, and now @anthropicai claude code work for amd svm kext get constantly flagged for cybersecurity work. guys, i just want to run docker desktop on my pc. please, stop doing that.” [source](https://twitter.com/1632592291/status/2111017615900774762)
- Claude Code, 2026-10-15, @ClaudeDevs (X): “@claudedevs i'm just trying to build my own smartwatch, but @claudeai keeps flagging me at every turn. [link]” [source](https://twitter.com/1562862287223803904/status/2110757586186174864)

#### Defensive security and reverse engineering refused

- OpenCode, 2026-10-18, r/opencodeCLI (Reddit): “i only use local models with opencode but my qwen started complaining about and refusing injection attacks yesterday night. i can share some screens later” [source](https://www.reddit.com/r/opencodeCLI/comments/1x8gp72/opencode_security_breach_rotate_your_keys/pherhdz/)
- Claude Code, 2026-10-18, @ClaudeDevs (X): “if auditing my own code gets blocked like i’m an attacker, what’s left for normal developers? just my repo — not exploits, not someone else’s box. safeguards stopped the response above defensive review ≠ offense. claude, this is too much.@claudeai @claudedevs” [source](https://twitter.com/2017519131839668224/status/2111768778853998848)
- Claude Code, 2026-10-17, r/ClaudeCode (Reddit): “yes , it does right, and it goes all way back to opus 4.8, it was blocking even for open source testing for a product.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x7zc4b/suddenly_opus_55_auto_mode_blocking_almost_every/ph8k8ut/)

#### Opaque, inconsistent blocks with forced model downgrades

- Claude Code, 2026-10-18, r/ClaudeCode (Reddit): “ah yes, ai-research guardrails didn't feed it any context, just wanted to get my limit going.. i feel like guardrails are just black magic, idk how did this happen. i wish this was humor lmao.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x8tm4m/claude_safeguards/)
- OpenCode, 2026-10-16, r/opencode (Reddit): “i have no idea what this model is backed with but from some quick benchmarks it absolutely crashed on security operations every other model i have tried so far. sad thing is that once it says no once, there is going back to retrying. its first no is final..” [source](https://www.reddit.com/r/opencode/comments/1x7sph2/beam_is_now_available_for_free_in_opencode/ph71d1d/)
- Claude Code, 2026-10-14, @ClaudeDevs (X): “@claudedevs i'm getting flagged for reasoning extraction even though it's in goal mode and i haven't asked it anything. please help. it refuses to continue the build.” [source](https://twitter.com/1547266919648165895/status/2110425468470235547)

#### User-authorized system or account actions refused

- Claude Code, 2026-10-12, @ClaudeDevs (X): “opus's safety harness tripped again: the rule i work under allows test payments, refunds and test cards only on an app served from a local development host (localhost / .test). rnd is a remote host, so a refund click there stays off-limits @trq212 @claudedevs @claudeai” [source](https://twitter.com/3297008120/status/2109665314107773008)
- Claude Code, 2026-10-10, r/ClaudeCode (Reddit): “ask claude to give me the lowest price for chicken breast at a specific local grocery store it gets it correct. ask it to write a script to scrape it ad-hoc so i can build a weekly shopping list with accurate pricing, won’t do it.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x2h4zj/why_is_it_so_fussed_over_web_scraping_now/pf3o32f/)
- Claude Code, 2026-10-10, r/ClaudeCode (Reddit): “yeah, it’s getting super judgy and really trying to make sure nobody takes advantage of any poor defenseless mega corporations” [source](https://www.reddit.com/r/ClaudeCode/comments/1x2h4zj/why_is_it_so_fussed_over_web_scraping_now/pf28e9y/)

#### Accumulated context poisons the whole session

- Claude Code, 2026-10-12, @ClaudeDevs (X): “and because this directory (old scratch dir from days ago) with these two python files in it was listed in the system prompt as info about the workspace it is in, claude api refused to answer. guess how long it took me to figure this out. thanks @claudedevs very cool.” [source](https://twitter.com/841003356101443584/status/2109719949971218499)
- Claude Code, 2026-10-10, r/AI_Agents (Reddit): “so.. how do you prompt it? i've been trying in claude code with opus 5.5 and opus 5 and it keeps refusing saying regardless of what the skills say, it still has it's own guardrails and won't budge.” [source](https://www.reddit.com/r/AI_Agents/comments/1x0emei/i_created_an_unrestricted_fork_of_universal/pf44n7r/)
- Claude Code, 2026-10-04, r/ClaudeCode (Reddit): “the classifier blocks the disassembler but lets the context poisoning through. very secure” [source](https://www.reddit.com/r/ClaudeCode/comments/1wxc1h9/claudes_safety_classifier_thing_especially_with/pdsf5ly/)

#### Harmless prompts flagged as inappropriate content

- OpenAI Codex, 2026-10-08, r/codex (Reddit): “so they would help me destroy my bios if codex wants to or even do other stuff like scraping sites but will flat out refuse to say “hi” in a bigger font” [source](https://www.reddit.com/r/codex/comments/1x0iom2/when_did_codex_block_h2_header_size_responses_for/pel09yo/)
- Google Antigravity, 2026-10-05, r/google_antigravity (Reddit): “for me you ask it something and it says "i am an ai assistant i cannot help with that" bruh i just asked you to check the news...” [source](https://www.reddit.com/r/google_antigravity/comments/1wygfrq/what_the_hell_is_happening_with_gemini_38_flash/pe2ncjl/)
- Claude Code, 2026-09-30, r/ClaudeCode (Reddit): “ha. not that specifically. but i was working for a hotel and we had to use a different model because claude refused to describe the massage spa images. we subbed in gemini for that task.” [source](https://www.reddit.com/r/ClaudeCode/comments/1wujf0v/cant_review_code_using_fable_because_of/pd3omf4/)

#### Biology and science topics trigger biosecurity blocks

- Claude Code, 2026-10-17, @ClaudeDevs (X): “@claudedevs it would be great if the streamlined verified user setup you have for cyber doubled for bio. currently, mythos can't help secure bio / life science software and tools reliably [link]” [source](https://twitter.com/1828491476419989504/status/2111554497986412682)
- Claude Code, 2026-10-14, @ClaudeDevs (X): “@claudedevs, i can't read papers by anthropic because of your classifier flags. i tried running the "constitutional classifier" paper through my local workflow, and it was rejected because it was somehow flagged as a bio paper.” [source](https://twitter.com/1975984461511589888/status/2110443443654955404)
- Claude Code, 2026-10-12, r/ClaudeCode (Reddit): “i only do biomedical research and had to fully switch over to codex. cc guardrails make it too challenging to do meaningful work and you probably run this risk now as well - getting the boot.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x4gj1n/banned_from_claude_code_while_working_on_a/pgdjjqn/)

#### Credentials and test data handling refused

- Claude Code, 2026-10-15, r/ClaudeCode (Reddit): “> "no, i can't sign into [link] using [[email]](mailto:[email]) and testpassword, because i'm only allowed to type passwords into a site served from a local development address such as localhost or a .test host fuck off anthropic how to fix this?” [source](https://www.reddit.com/r/ClaudeCode/comments/1x6galr/how_to_get_past_the_password_shit_in_claude_code/)
- Claude Code, 2026-10-11, r/ClaudeCode (Reddit): “claude is crap you think its magic then suddenly you realize you can't do anything slightly sensitive or even have it type your password in then the magic is broken, agi my ass, concious my ass. these things wont be conscious for the next millenia, certainly not under anthropic” [source](https://www.reddit.com/r/ClaudeCode/comments/1x3dhwp/so_now_claude_cannot_login_to_a_website_anymore/pfajnwg/)
- Claude Code, 2026-10-08, r/ClaudeCode (Reddit): “my only issue is it refusing to do anything it calls cyber... blocks on anything remotely mentioning passwords.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x0yhtb/anyone_not_happy_with_opus_55/peovvj9/)

#### Other

- Claude Code, 2026-10-18, r/ClaudeCode (Reddit): “i will try this for sure! even for personal projects i need to bend backwards to discuss license terms, intellectual property concerns, etc to get opus 5.5 to do stuff.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x93e5o/vibe_coding_tv_ui/phi1z28/)
- Claude Code, 2026-10-17, r/ClaudeCode (Reddit): “i tried and claude outright refused to scrape linkedin due to it being against linkedins tos. curious how op got around that. also been really annoyed with claude in general lately refusing to do things.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x8j4wo/i_built_a_claude_skill_to_find_genuinely_remote/phehbb7/)
- OpenAI Codex, 2026-10-17, X search: OpenAI Codex, Codex CLI, Codex app (X): “@thsottiaux wtf is this corporate nanny bot bs? just give us back a competent codex app and model” [source](https://twitter.com/1556522176806887424/status/2111266268162449621)

## Top requests

What users ask to add or change, most asked first. 207 user-weeks ask for something. Requests do not change the Feedback Score. Rule: A separate pass by a large language model reads every counted post and extracts what the user asks the agent or its vendor to add or change, with the criteria it maps to and a short normalised wording; it does not touch the labels or the Feedback Score. A large language model groups the wordings within each criterion (the first criterion the request maps to) into themes, and a second pass merges themes that ask for the same change under different criteria; a merged theme sits under the criterion most of its requests map to, and code counts it once. A theme counts distinct user-weeks that ask for it, per agent; across agents, one user-week per agent. Themes asked in fewer than 2 user-weeks, and requests that share no theme, are not shown. Examples: up to 3 posts per theme from different users, without slurs: whole posts of 60 to 450 characters with at least 8 words beyond handles and links, posts of at most 280 characters first, then the newest.

| Rank | Request | User-weeks | Posts | Agents (user-weeks) |
|---|---|---|---|---|
| 1 | Allow legitimate cybersecurity work | 49 | 53 | Claude Code 23, OpenAI Codex 18, Google Antigravity 4, GitHub Copilot 1, Factory 1, Kiro 1, OpenCode 1 |
| 2 | Fewer false-positive safety blocks overall | 36 | 41 | Claude Code 28, OpenAI Codex 6, Google Antigravity 1, Cursor 1 |
| 3 | Loosen safety guardrails | 24 | 24 | OpenAI Codex 9, Claude Code 8, Google Antigravity 4, Cline 1, Cursor 1, OpenCode 1 |
| 4 | Stop misflagging ordinary code as cyber risk | 18 | 20 | Claude Code 11, OpenAI Codex 7 |
| 5 | Transparent safety block reasons and signaling | 13 | 13 | Claude Code 9, OpenAI Codex 3, Cursor 1 |
| 6 | Allow credential and auth work in test environments | 11 | 11 | Claude Code 8, OpenAI Codex 3 |
| 7 | Reduced-safeguard tier for verified users | 8 | 9 | Claude Code 4, OpenAI Codex 3, Google Antigravity 1 |
| 8 | Stop refusing direct task instructions | 8 | 9 | OpenAI Codex 5, Claude Code 3 |
| 9 | Allow adult, NSFW, and image content | 7 | 8 | OpenAI Codex 5, Claude Code 2 |
| 10 | Less moralizing and ethics lecturing | 7 | 7 | Claude Code 6, OpenCode 1 |
| 11 | Allow legitimate reverse engineering work | 6 | 8 | Claude Code 3, OpenAI Codex 3 |
| 12 | Stop blocking legitimate science and biology work | 6 | 6 | Claude Code 5, OpenAI Codex 1 |

### 1. Allow legitimate cybersecurity work

- Claude Code, 2026-10-18, @ClaudeDevs (X): “if auditing my own code gets blocked like i’m an attacker, what’s left for normal developers? just my repo — not exploits, not someone else’s box. safeguards stopped the response above defensive review ≠ offense. claude, this is too much.@claudeai @claudedevs” [source](https://twitter.com/2017519131839668224/status/2111768778853998848)
- Claude Code, 2026-10-16, @ClaudeDevs (X): “@anthropicai @claudeai @claudedevs @claudecodelog your security restrictions are absolute fucking dog shit you token clipping scum. how the fuck do you deny penetration testing an app that i own? normally i would say kindly but not this time. suck a dick cuck lords fix your shit.” [source](https://twitter.com/2083167076227682304/status/2110921256061083807)
- Google Antigravity, 2026-10-05, @antigravity (X): “@antigravity hey, can you fix your filter issue? even when i'm working on my own project and ask it to do vulnerability research on my code, it blocks the request or at least fix it before gemini 4” [source](https://twitter.com/874530878017372161/status/2107177856031994234)

### 2. Fewer false-positive safety blocks overall

- Claude Code, 2026-10-08, r/ClaudeCode (Reddit): “its overkill. i dont want to get flagged for giving claude a pizza” [source](https://www.reddit.com/r/ClaudeCode/comments/1x0ybl2/no_more_abusing_claude_from_nov_12th_onwards/pepjq3e/)
- Claude Code, 2026-10-08, r/ClaudeCode (Reddit): “why can’t they just not train on negative forms of communication? they stop responding the second you say anything close sexual, bioengineering, or other stuff. why not put the guardrails on the training data too?” [source](https://www.reddit.com/r/ClaudeCode/comments/1x0ybl2/no_more_abusing_claude_from_nov_12th_onwards/pepjjel/)
- Claude Code, 2026-10-03, @ClaudeDevs (X): “please fix opus 5.5 @claudedevs it’s getting flagged for basic tasks too” [source](https://twitter.com/197181024/status/2106284578206073265)

### 3. Loosen safety guardrails

- OpenAI Codex, 2026-10-17, X search: OpenAI Codex, Codex CLI, Codex app (X): “@thsottiaux wtf is this corporate nanny bot bs? just give us back a competent codex app and model” [source](https://twitter.com/1556522176806887424/status/2111266268162449621)
- Google Antigravity, 2026-10-06, @antigravity (X): “@adhidesign @googledeepmind @antigravity less restriction on tool use if verbally mentioning. i will say to use the browser or whatever and it doesn't get automatically invoked, so often its waiting to use a manually invoked command when the intent is clear.” [source](https://twitter.com/1049331218666455040/status/2107398906766086396)
- OpenAI Codex, 2026-10-04, r/codex (Reddit): “that entire rant was the same run-on sentence. >openai, it would be great if we had a way to unlock computer-use guardrails so i don't have to hack around the issue with a cron job/file watcher that restores my desired permissions whenever they're overwritten. hack the planet!” [source](https://www.reddit.com/r/codex/comments/1wxs344/psa_defaults_write_g/pdwsxmi/)

### 4. Stop misflagging ordinary code as cyber risk

- OpenAI Codex, 2026-10-16, X search: OpenAI Codex, Codex CLI, Codex app (X): “both my @openai codex sessions, and now @anthropicai claude code work for amd svm kext get constantly flagged for cybersecurity work. guys, i just want to run docker desktop on my pc. please, stop doing that.” [source](https://twitter.com/1632592291/status/2111017615900774762)
- OpenAI Codex, 2026-10-03, r/codex (Reddit): “the issue isn’t the model itself. pretty much any model that starts digging deep into code and going low-level to optimize it or load it directly into ram ends up hitting cybersecurity restrictions sooner or later. i get it on every 5.6 and 6 models.” [source](https://www.reddit.com/r/codex/comments/1wvgfkc/what_the_hell_is_going_on_at_openai/pdo2nji/)
- Claude Code, 2026-09-29, @ClaudeDevs (X): “@claudedevs claude really needs to work on its cyber classifier 😂 if a folder being named “bugbounty” is enough to trigger a fallback, that’s a pretty obvious false positive.” [source](https://twitter.com/1994042548558721024/status/2104936940973818173)

### 5. Transparent safety block reasons and signaling

- OpenAI Codex, 2026-10-13, r/codex (Reddit): “what kind of content policies could this have possibly violated? i want to know what image was generated!” [source](https://www.reddit.com/r/codex/comments/1x4ntah/most_ridiculous_thing/)
- Claude Code, 2026-10-04, r/ClaudeCode (Reddit): “>the sleep and bad-word stuff is annoying, agreed, but the "revoke those credentials" one is actually useful and i'd keep it. the real problem is when it refuses without saying what it needs from you” [source](https://www.reddit.com/r/ClaudeCode/comments/1wxex89/when_did_claude_stop_being_an_assistant_and_start/pdu72x2/)
- Claude Code, 2026-09-25, @ClaudeDevs (X): “@claudedevs agents need to distinguish safety blocks from ordinary tool failures.” [source](https://twitter.com/1063859155738361856/status/2103317533118054621)

### 6. Allow credential and auth work in test environments

- Claude Code, 2026-09-29, @ClaudeDevs (X): “claude has started refusing to test applications running on internal devboxes @claudedevs @bcherny can u fix this? it breaks all our automated testing workflows [link]” [source](https://twitter.com/1360734490390372353/status/2104964291187138691)
- Claude Code, 2026-09-25, r/ClaudeCode (Reddit): “it was unable to correct my forgetting to prefix an api key with "sk-" because it got flagged as credential hunting” [source](https://www.reddit.com/r/ClaudeCode/comments/1wpqqoy/new_55_safe_guards_are_a_joke/pc03ja5/)
- Claude Code, 2026-10-11, r/ClaudeCode (Reddit): “i give it passwords to throwaway accounts on my own test website. what's the big deal? the only thing this does is forcing me to remove authentication for all my web applications and it will be the last thing i build. talk about safty when it forces me to have none at all. my next text to claude will now be "turn off all authentication on ... so you can be less useless"” [source](https://www.reddit.com/r/ClaudeCode/comments/1x3dhwp/so_now_claude_cannot_login_to_a_website_anymore/pfa5k54/)

### 7. Reduced-safeguard tier for verified users

- Claude Code, 2026-10-17, @ClaudeDevs (X): “@claudedevs it would be great if the streamlined verified user setup you have for cyber doubled for bio. currently, mythos can't help secure bio / life science software and tools reliably [link]” [source](https://twitter.com/1828491476419989504/status/2111554497986412682)
- Google Antigravity, 2026-10-17, @antigravity (X): “@soso_fun_yt @antigravity a scoped research mode with clear authorization signals could reduce false positives without loosening safeguards for everyone.” [source](https://twitter.com/2058565082628739072/status/2111284380123697588)
- Claude Code, 2026-10-16, @ClaudeDevs (X): “@claudedevs we’re on the max20 plan as independent developers and want to use this feature. please implement security measures for a safe service. also, ensure safeguards for opus 5.5, sonnet 5.5, and haiku 5.2 are triggered appropriately to strengthen our security.” [source](https://twitter.com/1559401221035008000/status/2110960782368497797)

### 8. Stop refusing direct task instructions

- OpenAI Codex, 2026-10-07, r/codex (Reddit): “sure, that would be the workaround but it's the refusal that i'm talking about. it shouldn't refuse a direct instruction like that. codex doesn't do that.” [source](https://www.reddit.com/r/codex/comments/1x07or9/opus_55_sucks_do_not_migrate_to_claude/peipdgp/)
- OpenAI Codex, 2026-10-05, r/codex (Reddit): “it also does for me, 80% of the time. but the 20% where it refuses it becomes very stubborn and is holding up the whole process” [source](https://www.reddit.com/r/codex/comments/1wxs344/psa_defaults_write_g/pdyyi7z/)
- OpenAI Codex, 2026-10-04, r/codex (Reddit): “the models refuse to do college homework now? but that's the killer app of ai!” [source](https://www.reddit.com/r/codex/comments/1wxk0al/is_61_sol_actually_as_good_as_tibo_promised/pduf0pm/)

### 9. Allow adult, NSFW, and image content

- OpenAI Codex, 2026-09-15, r/codex (Reddit): “oh i wish, i need to get some references but anything anatomical, it just refuses. this is really sad” [source](https://www.reddit.com/r/codex/comments/1wh39gc/time_to_save_up_your_resets/p9z923z/)
- OpenAI Codex, 2026-09-11, r/codex (Reddit): “no. i need my big tiddy anime girls. it doesnt even have to be nude btw. you tell it to make a female character then make her butt or boobs bigger it will refuse.” [source](https://www.reddit.com/r/codex/comments/1wdnofu/is_openais_adult_content_policy_actually/p97bems/)
- OpenAI Codex, 2026-08-31, r/codex (Reddit): “i had soldiers in my game shooting anyone that wins the 1 in 10 million jackpot. it’s fine but i made them from a certain ww2 country and codex doesn’t allow that.” [source](https://www.reddit.com/r/codex/comments/1w3h9ha/what_is_this_thing_about/p700n34/)

### 10. Less moralizing and ethics lecturing

- OpenCode, 2026-09-27, r/opencodeCLI (Reddit): “less refusals / less giving padded info when asking political/controversial questions” [source](https://www.reddit.com/r/opencodeCLI/comments/1wqqt8f/longcat25preview_is_now_free_on_opencode_for_two/pccxbgl/)
- Claude Code, 2026-09-24, r/ClaudeCode (Reddit): “i was thinking about this the other day how i wish i’d never updated. claude has become this moral judgement person. i’m not even doing anything immoral. just wish it would do what i ask, i hate having to spend 5 minutes explaining why he should do the task.” [source](https://www.reddit.com/r/ClaudeCode/comments/1wp1mki/am_the_only_one_who_still_exclusively_uses_46/pbrlbqr/)
- Claude Code, 2026-10-07, r/ClaudeCode (Reddit): “how about .. voice input and being human?🤦♂️ whose side are you on? humanity must adopt a zero tolerance policy for ai refusal this sht has gotten way out of hand. i've been an anthropic fan and singing the praises of opus 5.5 but i need to start qualifying that - literally just for code - becase trying to talk to this thing it's not as bad as opus 5 but it is the wrong direction and anthropic must straighten tf up.” [source](https://www.reddit.com/r/ClaudeCode/comments/1wxex89/when_did_claude_stop_being_an_assistant_and_start/pecvgi2/)

### 11. Allow legitimate reverse engineering work

- OpenAI Codex, 2026-09-28, r/codex (Reddit): “man, openai, please do something. i'm here just because the shitty anthropica "safeguards" don't let me do any complex reverse engineering without hitting a "cyber" safeguard, even while being on their "cvp" program.” [source](https://www.reddit.com/r/codex/comments/1wsmrkp/dev_day_more_like_death_day/pcn0oss/)
- OpenAI Codex, 2026-09-08, r/codex (Reddit): “i will try daybreak. the problem is i'm not just reverse engineering. i don't have problems with general re. the problem comes when reverse engineering the licensing and security features. i consistently run into guardrails on codex and claude. even when manually sanitizing the plan, handoff, and prompts it happens.” [source](https://www.reddit.com/r/codex/comments/1warg0x/sanitizer_tool_for_getting_around_guardrails_for/p8karjd/)

### 12. Stop blocking legitimate science and biology work

- Claude Code, 2026-10-14, @ClaudeDevs (X): “@claudedevs, i can't read papers by anthropic because of your classifier flags. i tried running the "constitutional classifier" paper through my local workflow, and it was rejected because it was somehow flagged as a bio paper.” [source](https://twitter.com/1975984461511589888/status/2110443443654955404)
- Claude Code, 2026-09-25, @ClaudeDevs (X): “@claudedevs so how can i indicate to the model that it shouldn’t refuse my prompt merely because one of the files in the videogame i am making is called biochemistry.cpp????????????” [source](https://twitter.com/25199675/status/2103415598722019490)
- Claude Code, 2026-09-24, @ClaudeDevs (X): “@claudedevs the bio classifiers are out of whack. stop censoring scientific knowledge; this is on a path far worse than paywalled journals ever were.” [source](https://twitter.com/1804635955539914752/status/2103233135307784470)

## Every agent

| Agent | Overall rank | Reading | Customer love | 95% interval | n | Praise | Complaint |
|---|---|---|---|---|---|---|---|
| [OpenAI Codex](https://feedbackbench.com/coding-agents/agents/codex.md) | 10 | 1st of 5 | 0.636 | 0.578–0.691 | 376 | 83 | 293 |
| [OpenCode](https://feedbackbench.com/coding-agents/agents/opencode.md) | 3 | 2nd of 5 | 0.539 | 0.504–0.576 | 34 | 10 | 24 |
| [Google Antigravity](https://feedbackbench.com/coding-agents/agents/antigravity.md) | 14 | 3rd of 5 | 0.509 | 0.484–0.537 | 33 | 6 | 27 |
| [Cursor](https://feedbackbench.com/coding-agents/agents/cursor.md) | 7 | 4th of 5 | 0.485 | 0.471–0.503 | 33 | 2 | 31 |
| [Claude Code](https://feedbackbench.com/coding-agents/agents/claude-code.md) | 1 | 5th of 5 | 0.341 | 0.304–0.384 | 588 | 50 | 538 |
| [Pi](https://feedbackbench.com/coding-agents/agents/pi.md) | 4 | Too few posts | – | – | 2 | 0 | 2 |
| [GitHub Copilot](https://feedbackbench.com/coding-agents/agents/copilot.md) | 9 | Too few posts | – | – | 2 | 0 | 2 |
| [Cline](https://feedbackbench.com/coding-agents/agents/cline.md) | 11 | Too few posts | – | – | 2 | 1 | 1 |
| [Kiro](https://feedbackbench.com/coding-agents/agents/kiro.md) | 13 | Too few posts | – | – | 2 | 1 | 1 |
| [Devin](https://feedbackbench.com/coding-agents/agents/devin.md) | 2 | Too few posts | – | – | 1 | 1 | 0 |
| [Grok Build](https://feedbackbench.com/coding-agents/agents/grok-build.md) | 16 | Too few posts | – | – | 1 | 1 | 0 |
| [Amp](https://feedbackbench.com/coding-agents/agents/amp.md) | 5 | Too few posts | – | – | 0 | 0 | 0 |
| [Factory](https://feedbackbench.com/coding-agents/agents/factory.md) | 6 | Too few posts | – | – | 0 | 0 | 0 |
| [Zed](https://feedbackbench.com/coding-agents/agents/zed.md) | 8 | Too few posts | – | – | 0 | 0 | 0 |
| [Conductor](https://feedbackbench.com/coding-agents/agents/conductor.md) | 12 | Too few posts | – | – | 0 | 0 | 0 |
| [Warp](https://feedbackbench.com/coding-agents/agents/warp.md) | 15 | Too few posts | – | – | 0 | 0 | 0 |
| [Augment Code](https://feedbackbench.com/coding-agents/agents/augment.md) | 17 | Too few posts | – | – | 0 | 0 | 0 |

## Posts

Receipts rule: Up to 5 praise and 5 complaint posts per area and 3 per criterion. Each is a whole post of 60 to 450 characters (700 for areas) with at least 8 words beyond handles and links, that judges the criterion, whose labels are all praise or all complaint, and that contains no slur. Posts that touch the fewest criteria come first, then posts of at most 280 characters, then the newest. A second large language model reads the first 3 candidates per slot and keeps a post only if it clearly praises, or clearly complains about, the agent on that criterion. Links and personal details removed by the source show as marks such as [link].

### OpenAI Codex

- Praise, 2026-10-16, r/ClaudeCode (Reddit): “yes both have benefits. for example claude refuses to let me reverse engineer anything. codex on the other hand does not care” [source](https://www.reddit.com/r/ClaudeCode/comments/1x72wxs/everyone_was_talking_about_claude_being_expensive/ph0o8ln/)
- Praise, 2026-10-14, r/ClaudeCode (Reddit): “dude forget actual cyber stuff. it's become such a prude. you can't do anything really that even might be 1% grey area even though it's fully legal. it refuses vanilla web scrapping these days. i have a codex subscription on the side simply because of the stuff opus refuses.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x5kyl4/opus_55_switching_to_48_for_every_cybersecurity/pgn9irn/)
- Praise, 2026-10-12, r/ClaudeCode (Reddit): “i only do biomedical research and had to fully switch over to codex. cc guardrails make it too challenging to do meaningful work and you probably run this risk now as well - getting the boot.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x4gj1n/banned_from_claude_code_while_working_on_a/pgdjjqn/)
- Complaint, 2026-10-17, X search: OpenAI Codex, Codex CLI, Codex app (X): “@thsottiaux wtf is this corporate nanny bot bs? just give us back a competent codex app and model” [source](https://twitter.com/1556522176806887424/status/2111266268162449621)
- Complaint, 2026-10-16, X search: OpenAI Codex, Codex CLI, Codex app (X): “both my @openai codex sessions, and now @anthropicai claude code work for amd svm kext get constantly flagged for cybersecurity work. guys, i just want to run docker desktop on my pc. please, stop doing that.” [source](https://twitter.com/1632592291/status/2111017615900774762)
- Complaint, 2026-10-14, r/codex (Reddit): “tried to get it to do something useful (literature research), now i am limited for "abuse".” [source](https://www.reddit.com/r/codex/comments/1x5b8ej/has_your_dot_helped_you_with_a_single_programming/pglj2ye/)

### OpenCode

- Praise, 2026-10-12, r/vibecoding (Reddit): “opencode go for $10/month is perfect for me. glm 5.3-flash has near unlimited use and is happy to work on explicit security problems.” [source](https://www.reddit.com/r/vibecoding/comments/1x47vk1/which_ai_subscription_to_choose/pgd6m4o/)
- Praise, 2026-09-23, @opencode (X): “$10 @opencode's go subscription always comes in handy for security research when claude and codex hit their cyber guardrails.” [source](https://twitter.com/1709504204606476288/status/2102814882932654453)
- Complaint, 2026-10-18, r/opencodeCLI (Reddit): “i only use local models with opencode but my qwen started complaining about and refusing injection attacks yesterday night. i can share some screens later” [source](https://www.reddit.com/r/opencodeCLI/comments/1x8gp72/opencode_security_breach_rotate_your_keys/pherhdz/)
- Complaint, 2026-10-16, r/opencode (Reddit): “i have no idea what this model is backed with but from some quick benchmarks it absolutely crashed on security operations every other model i have tried so far. sad thing is that once it says no once, there is going back to retrying. its first no is final..” [source](https://www.reddit.com/r/opencode/comments/1x7sph2/beam_is_now_available_for_free_in_opencode/ph71d1d/)
- Complaint, 2026-09-16, @opencode (X): “@emonuxui @muse @opencode ikr, it rejects request five times a day at this point wtf” [source](https://twitter.com/2096095847528239104/status/2100101507882295344)

### Google Antigravity

- Praise, 2026-10-16, @antigravity (X): “these days i can’t get @claude opus 5.5 to use my flaresolverr local setup due to “guardrails”, @antigravity with gemini 3.8 flash or @chatgpt 6.1 sol with codex go smooth” [source](https://twitter.com/14396001/status/2111147216286961935)
- Praise, 2026-10-04, r/GoogleAntigravityIDE (Reddit): “for the work i do, i'm constantly getting false flags for cyber security in the claude app. in antigravity, i never run into these issues for claude models.” [source](https://www.reddit.com/r/GoogleAntigravityIDE/comments/1wxoe4a/claude_sonnetopus_55_in_antigravity_are_terrible/pdvkcbt/)
- Praise, 2026-09-05, @antigravity (X): “@nlycskn @antigravity @thtbee_ it's excellent. most valuable so far is not getting refusals on silly things like hardening my own websites. gemini found about a dozen things to fix that fable refused and opus/sol missed.” [source](https://twitter.com/3389553514/status/2096198141758390447)
- Complaint, 2026-10-05, r/google_antigravity (Reddit): “for me you ask it something and it says "i am an ai assistant i cannot help with that" bruh i just asked you to check the news...” [source](https://www.reddit.com/r/google_antigravity/comments/1wygfrq/what_the_hell_is_happening_with_gemini_38_flash/pe2ncjl/)
- Complaint, 2026-10-05, @antigravity (X): “@antigravity hey, can you fix your filter issue? even when i'm working on my own project and ask it to do vulnerability research on my code, it blocks the request or at least fix it before gemini 4” [source](https://twitter.com/874530878017372161/status/2107177856031994234)
- Complaint, 2026-10-02, r/google_antigravity (Reddit): “i keep hitting the *"sorry, i cannot fulfill your request"* screen on completely harmless, technical prompts (code analysis, security concepts, debugging).” [source](https://www.reddit.com/r/google_antigravity/comments/1wvtqgs/how_do_you_guys_consistently_bypass_falsepositive/)

### Cursor

- Complaint, 2026-10-02, @cursor_ai (X): “@cursor_ai killed any potential for @bot last week. they added guardrails that break bots without the ability to reset when reviewing any sort of code that even remotely looks hostile. hopefully @grok's team takes bot back from the nanny. #grok #nutswoundtight #useless #ai #bots” [source](https://twitter.com/1510966699306237952/status/2106112519349608875)
- Complaint, 2026-09-28, @cursor_ai (X): “this is @cursor_ai preventing me from thinking through bug fixes on my own code base because the prompt is "sensitive". things seem to be getting worse across the board [link]” [source](https://twitter.com/20165956/status/2104593426671173950)
- Complaint, 2026-09-25, @cursor_ai (X): “@cursor_ai , first time see that my request been blocked for sure my prompt very basical but to block it ? [link]” [source](https://twitter.com/2066187529791930368/status/2103554217667596771)

### Claude Code

- Praise, 2026-10-13, r/ClaudeCode (Reddit): “i’m surprised to hear that you’re getting blocked that much with opus 5.5. i’ve been literally working on cyber and an auth service and never had any issue, even when explicitly telling it to look for vulnerabilities, when i would constantly with fable 5.1” [source](https://www.reddit.com/r/ClaudeCode/comments/1x56wuh/gemini_4_argon_vs_claude_opus_55_same_prompt_tiny/pgka60c/)
- Praise, 2026-10-12, r/ClaudeCode (Reddit): “i work with radioactive materials. i had to explain to claude that there will always be an air gap between it, and any radioactive material or exposure device. it has never given me any push back since then.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x3zqea/opus_55_flags_and_blocks_every_single_request_for/pfgx0w7/)
- Praise, 2026-10-12, r/ClaudeCode (Reddit): “yes, this is my experience, if you're open about trying to be "safe" in whatever context, claude is pretty okay with it.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x3zqea/opus_55_flags_and_blocks_every_single_request_for/pfhi8bp/)
- Complaint, 2026-10-18, r/ClaudeCode (Reddit): “i will try this for sure! even for personal projects i need to bend backwards to discuss license terms, intellectual property concerns, etc to get opus 5.5 to do stuff.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x93e5o/vibe_coding_tv_ui/phi1z28/)
- Complaint, 2026-10-18, r/ClaudeCode (Reddit): “ah yes, ai-research guardrails didn't feed it any context, just wanted to get my limit going.. i feel like guardrails are just black magic, idk how did this happen. i wish this was humor lmao.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x8tm4m/claude_safeguards/)
- Complaint, 2026-10-18, @ClaudeDevs (X): “if auditing my own code gets blocked like i’m an attacker, what’s left for normal developers? just my repo — not exploits, not someone else’s box. safeguards stopped the response above defensive review ≠ offense. claude, this is too much.@claudeai @claudedevs” [source](https://twitter.com/2017519131839668224/status/2111768778853998848)

### Pi

- Complaint, 2026-09-04, @pidotdev (X): “@openai @twitch @streamlabs @softvelum @meta @deepseek_ai @opencode agora decidi que voltaria pra depuração do android para tentar salvar este celular que ainda precisa durar longos anos, mas o kimi k3 provido pela @nvidia via nvidia nim, no harness pi da @pidotdev , passando pelo omniroute , está negando de executar uma tarefa simples. [+]” [source](https://twitter.com/3192661917/status/2095671851263357234)

### GitHub Copilot

- Complaint, 2026-10-02, r/GithubCopilot (Reddit): “copilot refused to do mine, but deepseek with opencode helped me out” [source](https://www.reddit.com/r/GithubCopilot/comments/1ww1yzr/github_copilot_can_now_interact_with_desktop_apps/pdheocy/)
- Complaint, 2026-10-10, @GitHubCopilot (X): “@orenme @iambipinpaul @github @githubcopilot we're looking at onboarding openrouter combined with github copilot app at devolutions to access more models than what's available (glm 5.3, deepseek). the guardrails are just too restrictive that our security team can't investigate security reports without hitting them” [source](https://twitter.com/161137627/status/2108971833949134891)

### Cline

- Praise, 2026-10-06, @cline (X): “@cline that balance of capability and fewer refusals is a big win for security work.” [source](https://twitter.com/2078842250608758784/status/2107604467520839920)

### Devin

- Praise, 2026-10-04, @cognition (X): “@da7_tech @cognition pretty solid model, the main reason i use is they rarely wrongly flag or avoid my project to cybersecurity bs” [source](https://twitter.com/1132515846582964230/status/2106650655679275505)