Years ago I was involved in a service where we some times had to disable accounts for abusive behavior. I'm talking about obvious abusive behavior, akin to griefing other users.
Every once in while someone would take it personally and go on a social media rampage. The one thing I learned from being on the other side of this is that if someone seems like an unreliable narrator, they probably are. They know the company can't or won't reveal the true reason they were banned, so they're virtually free to tell any story they want.
There are so many things about this article that don't make sense:
> I'm glad this happened with this particular non-disabled-organization. Because if this by chance had happened with the other non-disabled-organization that also provides such tools... then I would be out of e-mail, photos, documents, and phone OS.
I can't even understand what they're trying to communicate. I guess they're referring to Google?
There is, without a doubt, more to this story than is being relayed.
"I'm glad this happened with Anthropic instead of Google, which provides Gemini, email, etc. or I would have been locked out of the actually important non-AI services as well."
Non-disabled organization = the first party provider
Disabled organization = me
I don't know why they're using these weird euphemisms or ironic monikers, but that's what they mean.
Because they bought a claude subscription on a personal account and the error message said that they belongs to a "disabled organization" (probably leaking some implementation details).
Anthropic banned the author for doing nothing wrong, and called him an organisation for some reason.
In this case, all he lost was access to a service which develops a split personality and starts shouting at itself, until it gets banned, rather than completing a task.
Google also provides access to LLMs.
Google could also ban him for doing nothing wrong, and could refer to him as an organisation, in which case he would lose access to services providing him actual value (e-mail, photos, documents, and phone OS.)
Another possibility is there (which was my first reading before I changed my mind and wrote the above):
Google routes through 3rd-party LLMs as part of its service ("link to a google docs form, with a textbox where I tried to convince some Claude C"). The author does nothing wrong, but the Claude C reading his Google Docs form could start shouting at itself until it gets Google banned, at which point Google's services go down, and the author again loses actually valuable services.
Because what is meant by "this organization has been disabled" is fairly obvious. The object in Anthropic's systems belonging to the class Organization has changed to the state Disabled, so the call cannot be executed. Anthropic itself is not an organization in this sense, nor is Google, so I would say that referring to them as "non-disabled organizations" is an equivocation fallacy. Besides that, I can't tell if it's a joke, if it's some kind of statement, or what is being communicated. To me it's just obtuseness for the sake of itself.
It’s a joke because they do not see themselves as an organization, they bought a personal account, were banned without explanation and their only communication refers to them as a “disabled organization”.
Anthropic and Google are organizations, and so an “un disabled organization” here is using that absurdly vague language as a way to highlight how bad their error message was. It’s obtuseness to show how obtuse the error message was to them.
Some things are obtuse but still clear to everyone despite the indirection, like the error message they got back. Their description of what caused it is obtuse but based on this thread is not clear to quite a few people (myself included). It's not dunking on the error message to reuse the silly but clear terminology in a way that's borderline incoherent.
Yes, even if you create a single person account, you create an 'organization' to be billed. That's the whole confusion here. Y'all seemingly don't have an account at anthropic?
No, Anthropic didn't call him an organization. Anthropic's API returned the error "this organization has been disabled". What in that sentence implies that "this" is any human?
>Because what is meant by "this organization has been disabled" is fairly obvious. The object in Anthropic's systems belonging to the class Organization has changed to the state Disabled, so the call cannot be executed.
No, "another non-disabled organization" sounds like they used the account of someone else, or sockpuppet to craft the response. He was using "organization" to refer to himself earlier in the post, so it doesn't make sense to use that to refer to another model provider.
No, I don't think so. I think my interpretation is correct.
> a textbox where I tried to convince some Claude C in the multi-trillion-quadrillion dollar non-disabled organization
> So I wrote to their support, this time I wrote the text with the help of an LLM from another non-disabled organization.
> My guess is that this likely tripped the "Prompt Injection" heuristics that the non-disabled organization has.
A "non-disabled organization" is just a big company. Again, I don't understand the why, but I can't see any other way to interpret the term and end up with a coherent idea.
It seems just as likely to me that they're just using their terminology inconsistently as it is that they're using it consistently but with that egregious amount of ambiguity. The only thing that I'm confident about is that they're communicating in a very confusing way, and that doesn't really give me any strong insight into whether they're being consistent but vague or just plain vague.
Again, I don't agree. If you replace every instance of "non-disabled organization" with just "company", the sentences make sense. There's no need to suppose that the term means anything else, when this interpretation resolves all the outstanding questions satisfactorily and simply.
Just want to say thank you for being patient and rational. Reading your comments in this thread, they're like a soothing bandaid over all this flustered upset.
I wish there were more comments like yours, and fewer people getting upset over words and carrying what feels like resentment into public comments.
Apologies to all for this meta comment, but I'd like to send some public appreciation for this effort.
Sure, but that's not what they said, which is why it's confusing. Earlier in the article they referred to themselves as the "disabled organization", so it's not obvious to me that there's change in what they mean by the word to an entirely different one. Your explanation is plausible and consistent, but that doesn't necessarily mean it's correct, and I don't think that being internally consistent is sufficient evidence to conclude that something is true.
Okay, but if you won't be satisfied by a plausible and consistent answer then you won't be satisfied by any answer. Even if the author themselves stood in front of you and told you what they meant when they used the phrase, that would still be unsatisfactory because they could still be using language inconsistently and incorrectly.
I’m sorry but the fact this has turned into a multi comment debate is proof that that phrase was way too ambiguous to be included. That phrase made no sense and the article, while unreliable, would have at least been more readable without it.
Is it? It sounded to me like they're still using the other Claude instance (Claude B, using their terminology in the article). I could be wrong though, which I guess would just be more evidence that they were more confusing in their phrasing than they needed to be.
Tangential but you reminded me of why I don't give feedback to people I interview. It's a huge risk and you have very low benefit.
It once happened to me to interview a developer who's had a 20-something long list of "skills" and technologies he worked with.
I tried basic questions on different topics but the candidate would kinda default to "haven't touched it in a while", "we didn't use that feature". Tried general software design questions, asking about problems he solved, his preferences on the way of working, consistently felt like he didn't have much to argue, if he did at all.
Long story short, I sent a feedback email the day later saying that we had issues evaluating him properly, suggested to trim his CV with topics he liked more to talk about instead of risking being asked about stuff he no longer remembered much. And finally I suggested to always come prepared with insights of software or human problems he solved as they can tell a lot about how he works because it's a very common question in pretty much all interview processes.
God forbid, he threw the biggest tantrum on a career subreddit and linkedin, cherrypicking some of my sentences and accusing my company and me to be looking for the impossible candidate, that we were looking for a team and not a developer, and yada yada yada. And you know the internet how quickly it bandwagons for (fake) stories of injustice and bad companies.
It then became obvious to me why corporate lingo uses corporate lingo and rarely gives real feedback. Even though I had nothing but good experience with 99 other candidates who appreciated getting proper feedback, one made sure I will never expose myself to something like that ever again.
The farm of servers that decided by probably some vibe-coded mess to ban account is actively being paid for by customer that banned it.
Like, there is some reasons to not disclose much to free users like making people trying to get around limits have more work etc. but that's (well) paid user, the least they deserve is a reason, and any system like that should probably throw a warning first anyway.
I had a somewhat similar experience. For one particular position we were interviewing a lot of junior and recent grad developers. Since so many of the applicants were relatively new to the game, they were almost all (99% I'd guess) extremely grateful for the honest feedback. We even had candidates asked to stay in contact with us and routinely got emails from them months or years down the road thinking us for our feedback and mentorship. It took a lot of extra time from us that could have been applied to our work, but we felt so good about being able to do that for people that it was worth it to us.
Then a lawsuit happened. One of the candidates cherry-picked some of our feedback and straight up made up some stuff that was never said, and went on a social media tirade. After typical internet outrage culture took over, The candidate decided to lawyer up and sue us, claiming discrimination. The case against us was so laughably bad that if you didn't know whether it was real or not, you could very reasonably assume this was a satire piece. Our company lawyer took a look at it, and immediately told us that it was clearly intended to get to some settlement, and never actually see any real challenge. The lawyer for the candidate even admitted as much when we met with them. Our company lawyer pushed hard to get things into arbitration, but the opposing did everything they could to escalate up the chain to someone who would just settle with them.
Well, it worked. Company management decided to just settle with a non-disparagement clause. They also came down with a policy of not allowing software engineers to talk directly with candidates other than during interviews when asking questions directly. We also had to have an HR person in the room for every interview after that. We had to 180 and become people who don't provide any feedback at all. We ended up printing a banner that said no good deed goes unpunished and hung it in our offices.
Had a similar experience, like 20 years ago. This somehow made me remember his name - so I just checked out what he's been up to professionally. It seems quite boring, "basic" and expected. He certainly didn't reach what he was shooting for.
I wonder if there needs to be an "NDA for feedback"... or at least a "non-disparagement agreement".
Something along the lines of "here's the contract, we give you feedback, you don't make it public [is some sharing ok? e.g. if they want to ask their life coach or similar], if you make it public the penalty is $10000 [no need to be crazy punitive], and if you make it public you agree we can release our notes about you in response."
(Looking forward to the NALs responding why this is terrible.)
> Looking forward to the NALs responding why this is terrible.
My NAL guess is that it will go a little like this:
* Candidate makes disparaging post on reddit/HN.
* Gets many responses rallying behind him.
* Company (if they notice at all) sues him for breach of Non-Disparagement-Agreement.
* Candidate makes followup post/edit/comment about being sued for their post.
* Gets even more responses rallying behind him.
Result: Company gets $10.000 and even more damage to their image.
(Of course it might discourage some people from making that post to begin with, which would have been the goal. You might never try to enforce the NDA to prevent the above situation. Then it's just a question of: Is the effort to draft the NDA worth the reduction in risk of negative exposure, when you can simply avoid all of it by not providing feedback.)
> I'm talking about obvious abusive behavior, akin to griefing other users
Right, but we're talking about a private isolated AI account. There is no sense of social interaction, collaboration, shared spaces, shared behaviors... Nothing. How can you have such an analogue here?
I was thinking more of Mr. Wizard's demonstration of flour blown through a plastic tube into a funnel containing said flour (or whatever) with a flame above it made a "whoosh" type flame ball.
or places that mill anything that don't clean their rafters, who then get a tool crashing into a work piece, which shakes the building, which throws all the dust into the air, which is then sparked off by literally anything. like low humidity.
The excerpt you don’t understand is saying that if it has been Google rather than Anthropic, the blast radius of the no-explanation account nuking would have been much greater.
It’s written deliberately elliptically for humorous effect (which, sure, will probably fall flat for a lot of people), but the reference is unmistakable.
If company bans you for a reason they are not going to disclose, they deserve all of the bad PR they get from it.
> Years ago I was involved in a service where we some times had to disable accounts for abusive behavior. I'm talking about obvious abusive behavior, akin to griefing other users.
But this isn't service where you can "grief other users". So that reason doesn't apply. It's purely "just providing a service" so only reason to be outright banned (not just rate limited) is if they were trying to hack the provider, and frankly "the vibe coded system misbehaving" is far more likely cause.
> Every once in while someone would take it personally and go on a social media rampage. They know the company can't or won't reveal the true reason they were banned, so they're virtually free to tell any story they want.
The company chose to arbitrarily some rules vaguely related to the ToS that they signed and decided that giving a warning is too much work, then banned their account without actually saying what was the problem. They deserve every bit of bad PR.
>> I'm glad this happened with this particular non-disabled-organization. Because if this by chance had happened with the other non-disabled-organization that also provides such tools... then I would be out of e-mail, photos, documents, and phone OS.
> I can't even understand what they're trying to communicate. I guess they're referring to Google?
They are saying getting banned with no appeal, warning, or reason given from service that is more important to their daily lives would be terrible, whether that's google or microsoft set of service or any other.
I think the author was doing some sort of circular prompt injection between two instances of Claude? The author claims "I'm just scaffolding a project" but that doesn't appear to be the case, or what resulted in the ban...
One Claude agent told other Claude agent via CLAUDE.md to do things certain way.
The way Claude did it triggered the ban - i.e. it used all caps which apparently triggers some kind of internal alert, Anthropic probably has some safeguards to prevent hacking/prompt injection and what the first Claude did to CLAUDE.md triggered this safeguard.
And it doesn't look like it was a proper use of the safeguard, they banned for no good reason.
It wasn’t circular. TFA explains how the author was always in the loop. He had one Claude instance rewrite the CLAUDE.MD of another Claude instance whenever the second one made a mistake, but relaying the mistake to the first instance (after recognizing it in the first place) was done manually by the author.
I suspeect that having Claudes talking to Claudes is a very bad idea from Anthropic's point of view because that could easily consume a ton of resources doing nothing useful.
My take was more a kind of amusing laughing-through-frustration but also enjoying the ride just a little bit insouciance. Tastes vary of course, but I enjoyed the author's tone and pacing.
I wouldn't say "unhinged" either, but maybe just struggling to organize and express thoughts clearly in writing. "Organizations of late capitalism, unite"?
The author was frustrated that the error message identified him as an organisation (that was disabled) and mockingly refers to himself as the (disabled) organisation in the post.
At least, that’s my reading but it appears it confuses about half of the commenters here.
the former i have heard for a couple decades, the latter is apparently a term of art to prevent hurt feelings or lawsuits or something.
Google thinks i want ADA style organizations, but it's AI caught on that i might not mean organizations for disabled people
btw "ADA" means Americans with Disabilities Act. AI means Artificial Intelligence. A decade is 10 years long. "term of art" is a term of art for describing stuff like jargon or lingo of a trade, skill, profession.
Jargon is specialized, technical language used in a field or area of study. Lingo pins to jargon, but is less technical.
Google is a company that started out crawling the web and making a web search site that they called a search engine. They are now called Alphabet Company (ABC). Crawling means to iteratively parse the characters sent by a webserver and follow links therein, keeping a copy of the text from each such html. HTML is hypertext markup language, hypertext is like text, but more so.
Language is how we communicate.
I can go on?
p.s. if you want a better word, your complaint is about the framing. you didn't gel with the framing of the article. My friend, who holds a doctorate, defended a thesis about how virtually every platform argument is really a framing issue. platform as in, well, anything you care to defend. mac vs linux, wifi vs ethernet, podcasts vs music, guns vs no guns, red vs blue. If you can reduce the frame of the context to something both parties can agree to, you can actually hold a real, intellectual debate, and get at real issues.
The author was using instance A of Claude to update a `claude.md` while another instance B of Claude was consuming that file. When Claude B did something wrong, the author asked Claude A to update the `claude.md` so that Claude B didn’t make the same mistake again
More likely explanation: Their account was closed for some other reason, but it went into effect as they were trying this. They assumed the last thing they were doing triggered the ban.
This does sound sus. I have CC update other project's claude.md files all the time. I've got a game engine that I'm tinkering with. The engine and each of the game concepts I play around with have their own claude.md. The purpose of writing the games is to enhance the engine, so the games have to be familiar with the engine and often engine features come from the game CC rather than the engine CC. To keep the engine CC from becoming "lost" about features implemented each game project has instructions to update the engine's claude.md when adding / updating features. The engine CC bootstraps new game projects with a claude.md file instructing it how to keep the engine in sync with game changes as well as details of what that particular game is designed to test or implement within the engine. All sorts of projects writing to other project's claude.md files.
This 100%. I'm not sure why the author as well as so many in the thread are assuming a ToS ban was literally instant and had to be due to what the author was doing in that moment. Could have been for something the author did hours, days, or weeks ago. There would be no way to know.
I don't understand how having two separate instances of Claude helps here. I can understand using multiple Claude instances to work in parallel but in this case, it seems all this process is linear...
If you look at the code it will be obvious. Imagine I’m the creator of React. When someone does “create new app” I want to put a Claude.md in the dir so that they can get started easily.
I want this Claude.md to be useful. What is the natural solution to me?
I'd probably do it like this: ask Claude to do a task, and when it fails, have it update its Claude.md so it doesn’t repeat the mistake. After a few iterations, once the Claude.md looks good, just copy-paste it into the scaffolding tool.
Right, so you see the part where you "ask Claude to do a task" and then "copy-paste it into the template"? He was automating that because he has some n tasks he wants it to do without damaging the prior tasks.
You can just clear the context or restart your Claude instance between tasks. e.g.:
> do task 1
...task fails...
> please update Claude.md so you don't make X mistake
> /clear
> do task 2
... task fails ...
> please update Claude.md so you don't make Y mistake
> /clear
etc.
If you want a clean state between tasks you can just commit your Claude.md and `git reset --hard`.
I just don't get why you'd need have to a separate Claude that is solely responsible for updating Claude.md. Maybe they didn't want to bother with git?
Presumably they didn't want to sit there and monitor Claude Code doing this for each of the 14 things they want done. Using a harness around Claude Code (or its SDK) is perfectly sane for this. I do it routinely. You just automate the entire process so that if you change APIs or you change the tasks, the harness can run and ensure that all of your sets are correctly re-done.
Sitting there and manually typing in "do thing 1; oh it failed? make it not fail. okay, now commit" is incredibly tedious.
They said they were copy/pasting back and forth. But regardless, what do you mean by "harness" and "sets"? Are you referring to a specific tool that orchestrates Claude Code instances? This is not terminology I'm familiar with in this context. If you have any link that explains what you are talking about, would be appreciated.
Ah, it's unfortunate. I think we just lack a common language. Another time, perhaps.
You're correct that his "pasting the error back in Claude A" does sort of make the whole thing pointless. I might have assumed more competence on his side than is warranted. That makes the whole comment thread on my side unlikely to be correct.
Which shouldn't be bannable imo. Rate throttle is a more reasonable response. But Anthropic didn't reply to the author, so we don't even know if it's the real reason they got banned.
When a company won't tell you what you did wrong, you should be free to take the least charitable interpretation towards the company. If it was more charitable, they'd tell you.
I mean, what a country should do it put a law in effect. If you ban a user, the user can submit a request with their government issued ID and you must give an exact reason why they were banned. The company can keep this record in encrypted form for 10 years.
Failure to give the exact reason will lead to a $100,000 fine for the first offense and increase from there up to suspension of operations privileges in said country.
"But, but, but hackers/spammers will abuse this". For one, boo fucking hoo. For two, just add to the bill "Fraudulent use of law to bypass system restrictions is a criminal offense".
This puts companies in a position where they must be able to justify their actual actions, and it also puts scammers at risk if they abuse the system.
Companies will simply give some kind of standard answer, that is legally "cover our butts" and be done with it.
Its like that cookie wall stuff, how much dark patterns are implemented. They followed the letter of the law, not the spirit of the law.
To be honest, i can also see the point from the company side. Giving a honest answer can just anger people, to the point they sue. People are often not as rational as we all like our fellow humans to be.
Even if the ex-client lose in court, that is how much time you wasted on issue clients... Its one thing if your a big corporation with tons of lawyers but small companies are often not in the position to deal with that drama. And it can take years to resolve. Every letter, every phone call to a lawyer, it stacks up fast! Do you get your money back? Maybe, depends on the country, but your time?
I am not pro companies but its often simply better to have the attitude "you do not want me as your client, let me advocate for your competitor and go there".
>Giving a honest answer can just anger people, to the point they sue.
Again, I'm kind of on a 'suck it dear company' attitude. The reason they ban you must align with the terms of service and must be backed up with data that is kept X amount of time.
Simply put, we've seen no shortage of individuals here on HN or other sites like Twitter that need to use social media to resolve whatever occurred because said company randomly banned an account under false pretenses.
This really matters when we are talking about giants like Google, or any other service in a near monopoly position.
Normally you can customize the agents behavior via a CLAUDE.md file. OP automated that process by having another agent customize the first agent. The customizer agent got pushy, the customized agent got offended, OP got banned.
My rudimentary guess is this. When you write in all caps, it triggers sort of a alert at Anthropic, especially as an attempt to hijack system prompt. When one claude was writing to other, it resorted to all caps, which triggered the alert, and then the context was instructing the model to do something (which likely would be similar to a prompt injection attack) and that triggered the ban. not just caps part, but that in combination of trying to change the system characteristics of claude. OP does not know much better because it seems he wasn't closely watching what claude was writing to other file.
if this is true, the learning is opus 4.5 can hijack system prompts of other models.
> When you write in all caps, it triggers sort of a alert at Anthropic
I find this confusing. Why would writing in all caps trigger an alert? What danger does caps incur? Does writing in caps make a prompt injection more likely to succeed?
from what i know, it used to be that if you want to assertively instruct, you used all caps. I don't know if it succeeds today. I still see prompts where certain words are capitalized to ensure model pays attention. What i mean was not just capitalization, but a combination of both capitalization and changing the behavior of the model for trying to get it to do something.
if you were to design a system to prevent prompt injections and one of surefire ways is to repeatedly give instructions in caps, you would have systems dealing with it. And with instructions to change behavior, it cascades.
Wait what? Really? All caps is a bannable offense? That should be in all caps, pardon me, in the terms of use if that's the case. Even more so since there's no support at the highest price point.
Its a combination. All caps is used in prompts for extra insistence, and has been common in cases of prompt hijacking. OP was doing it in combination with attempting to direct claude a certain way, multiple times, which might have looked similar to attempting to bypass teh system prompt.
Yeah, referring to yourself once as a "disabled organisation" is a good bit, referencing anthropics silly terminology. Keeping it for the duration made this a very hard follow
They probably organize individual accounts the same as organization accounts for larger groups of users at the same company internally since it all rolls up to one billing. That's my first pass guess at least.
You are confused because the message from Claude is confusing. Author is not an organization, they had an account with anthropic which got disabled and Anthropic addressed them as organization.
> Author is not an organization, they had an account with anthropic which got disabled and Anthropic addressed them as organization.
Anthropic accounts are always associated with an organization; for personal accounts the Organization and User name are identical. If you have an Anthropic API account, you can verify this in the Settings pane of the Dashboard (or even just look at the profile button which shows the org and account name.)
I've always kind of hated that anti-pattern in other software I use for peronal/hobby purposes, too. "What is your company name? [required]" I don't have a company! I'm just playing around with your tool on my own! I'm not an organization!
> I think I kind of have an idea what the author was doing, but not really.
Me neither; However, just like the rest I can only speculate (given the available information): I guess the following pieces provide a hint what's really going on here:
- "The quine is the quine" (one of the sub-headline of the article) and the meaning of the word "quine".
- Author's "scaffolding" tool which, once finished, had acquired the "knowledge"[1] how to add a CLAUDE.md baked instructions for a particular homemade framework (he's working on).
- Anthropic saying something like: no, stop; you cannot "copy"[1] Claude knowledge no matter how "non-serious" your scaffolding tool or your use-case is: as it might "shows", other Claude users, that there's a way to do similar things, maybe that time, for more "serious" tools.
---
[1]. Excerpt from the Author's blog post: "I would love to see the face of that AI (Claude AI system backend) when it saw its own 'system prompt' language being echoed back to it (from Author's scaffolding tool: assuming it's complete and fully-functional at that time)."
From reading the whole thing, it kind of seems clickbaity. Yes, they're the only user in the "organization" that got banned, but they apparently still are using the other "organization" without issue, so they as a human are not banned. There's certainly a valid complaint to be made about the lack of recourse or customer service response for the automated ban, but it almost seems like they intentionally were trying to be misleading by implying that since they were the only member of the organization, they were banned from using Claude.
Sounds like OP has multiple org accounts with Anthropic.
The main one in the story (disabled) is banned because iterating on claude.md files looks a lot like iterating on prompt injections, especially as it sounds the multiple Claude's got into it with each other a bit
The other org sounds like the primary account with all the important stuff. Good on OP for doing this work in a separate org, a good recommendation across a lot of vendors and products.
I think I kind of have an idea what the author was doing, but not really.