[rawicki]

For me definitely the worst regression was the system prompt telling claude to analyze file to check if it's malware at every read. That correlates with me seeing also early exhausted quotas and acknowledgments of "not a malware" at almost every step.

It is a horrible error of judgement to insert a complex request for such a basic ability. It is also an error of judgement to make claude make decisions whether it wants to improve the code or not at all.

It is so bad, that i stopped working on my current project and went to try other models. So far qwen is quite promising.

[bcherny]

I don't think that's accurate. The malware prompt has been around since Sonnet 3.7. We carefully evaled it for each new model release and found no regression to intelligence, alongside improved scores for cyber risk. That said, we have removed the prompt for Opus 4.6 since it no longer needed it.

[rawicki]

I started seeing "not a malware, continuing" in almost every reply since around 2 weeks ago. Maybe you just reintroduced it with some regression? Opus 4.6

[bcherny]

That's weird. Would you mind running /feedback and sharing the id here next time you see this? I'd love to debug

[rawicki]

Sure, I really appreciate you looking at this.

a6edd0d1-a9ed-4545-b237-cff00f5be090 / https://github.com/anthropics/claude-code/issues/47027

I'm happy to provide any other info that can be useful (as long as i'm not sharing any information about the code or tools we use into a public github issue).

[bcherny]

Thanks for the report! This was fixed in v2.1.92.

Please:

1. Upgrade to the latest: claude update (seems like you did this already)

2. Start a new conversations (resuming an old convo may trigger this bug again in that convo)

[egamirorrim]

This is bloody great Boris. Thank you.

[bcherny]

Thank you! Looking

[obrajesse]

I’ve seen this a couple of times recently. Including right after compact. I’ll /feedback it next time I see it

[ElFitz]

Same. Will run it too when I next get it.

[bavell]

I've been using CC a decent amount the past few weeks and have never seen this malware stanza...?

[echelon]

1. I've never seen this. Is there a config option to unhide it if it's happening? Is this in Claude Code? Does it have to be set to verbose or something?

2. Can we pay more/do more rigorous KYC to disable it if it's active?

[bcherny]

This warning is not enabled for modern models. No action needed. I'm digging into the report above as soon as they're able to /feedback.