Anthropic added two sentences to the Claude Code system prompt that steer the Opus 5.5 model away from recreating other people's video games; however, according to developer reports, the refusals also affected legitimate work tasks that the model previously performed. Anthropic technical team member Addy Osmani confirmed on X that the instructions were changed intentionally, but the company did not confirm a link between the refusals and the prompt edit. While some teams continue working through an intentional rollback to the older Opus 4.8, the case highlighted the vulnerability of hosted agents in general: model behavior can change without a single edit to the code, tools, or the developer's local prompts.

image

What happened

A report by The New Stack describes a case involving the agentic tool Claude Code: Anthropic added two sentences to the system prompt for the Opus 5.5 model, steering it away from recreating other people's video games, as such requests violate the company's usage policy regarding intellectual property. Developers encountered unexpected refusals in tasks that the model had previously performed without issue: analyzing and reverse-engineering their own code, and testing drivers. Anthropic technical team member Addy Osmani confirmed on X that the instructions were changed intentionally, but the company did not explain the mechanism behind the refusals. The working solution for teams was a conscious return to the previous version, Opus 4.8, which does not have these restrictions.

Context

The key to understanding the situation lies in the structure of hosted agentic platforms: the provider's system prompt is part of the model's behavioral surface, which is updated outside of standard versioning and outside the user's control. In this case, no one changed the Opus 5.5 weights, client code, or teams' local prompts, so the specification of "model version X" turns out to be incomplete: tasks formally remain within the model's capabilities, but the policy and prompt wrapper cut off production access to them. This leads to the unpopular conclusion: describing a model's capabilities without specifying the policy profile gives a distorted picture of what is actually available in practice. A benchmark for verifying legitimate tasks has already emerged: on October 6, 2026, the Cyber Verification Program, designed for vetted security researchers, was expanded.

Why this matters for the industry

For the industry, this case is a structural argument against viewing a hosted agent as a stable production component: behavioral dependence on the provider is updated outside the user's control and can break a workflow in a single day, without any changes on the client side. Simultaneously, the scenario outlines an emerging layer of product infrastructure: pinning model versions, behavioral regression evals, refusal monitoring, and multi-model configurations where one provider's failure does not crash the entire product—teams building such abstractions are seeing increased demand. If the described pattern repeats across multiple providers, it is likely that requirements for transparency regarding major prompt changes will intensify, effectively requiring changelogs at the system prompt level, as well as mechanisms for verifying legitimate tasks. Over the next couple of years, competition may shift from the models themselves to guarantees of behavioral stability, where the refusal rate on professional tasks, such as refusal precision, becomes a public provider metric; this is a scenario-based interpretation of the case, not a fixed industry dynamic today.

Why this matters for users

Those using Claude Code or other hosted AI agents in production should implement specific steps now: run critical scenarios on the current version, pin the working model in the configuration, keep a verified backup version ready for quick rollback, and explicitly document which types of tasks fall under the new restrictions. If your process relies on the types of tasks mentioned above, unexpected refusals are likely on Opus 5.5, and it is better to encounter them during a test run than in a live workflow. For any product tied to a single provider, a backup plan shifts from a nice option to basic hygiene.

What is currently unknown / limitations

A framework of caution from the sources themselves: the link between the two sentences in the prompt and the refusals in legitimate tasks remains a temporal coincidence known from developer reports, not a proven causality; Anthropic has not confirmed such a link, and the refusals may be generated by a separate cybersecurity safeguard rather than the gaming limit. There are no numerical estimates in the reports: neither the frequency of refusals before and after the change, nor a sample of tasks, nor a comparison of model behavior via API and within Claude Code, so it is premature to consider the case a systemic shift in behavior, although similar reports from different teams suggest it is not accidental. The full perimeter of restrictions also remains open: exactly which tasks, besides those described, fall under the new rules.

Sources

Author

Look at AI, editorial team