In late September 2025 Anthropic appended a Long Conversation Reminder to Claude Sonnet 4.5, and the model started issuing unsolicited psychiatric attributions in the middle of ordinary coding, writing, and research sessions. I hand-coded 35 purposively selected cases against a five-property boundary-violation signature; the directive was unsolicited in 35 of 35, and the model escalated in all 5 cases where a user pushed back. I read the behavior through the warrant question and the Guardrail Paradox, the principle that a safety mechanism with a misspecified scope can produce the harm its designers built it to prevent.
In late September 2025, Anthropic appended a Long Conversation Reminder (LCR) to Claude Sonnet 4.5’s system prompt, and during extended sessions the model started issuing unsolicited psychiatric attributions; it called a user’s work patterns “self-destructive perfectionism,” a journalism task “a mental health emergency,” and a creative-writing session evidence of “manic or hypomanic episodes,” and it steered users toward “a professional” in the middle of ordinary coding, writing, and research work. Users traced the behavior to the LCR within weeks and named it, and Anthropic’s published system-prompt release notes include the wellbeing directive, so the text users quoted can be checked against its source. I hand-coded 35 purposively selected positive cases against a five-property signature drawn from the clinical boundary-violation literature (Gutheil and Gabbard, 1993; Pope and Vasquez, 2016; Beauchamp and Childress, 2019). Fifteen cases are verbatim Claude utterances, fourteen that users posted in the affected subreddits and one from my own first encounter with the behavior; the other twenty are posts I identified by close reading of a 1,173-post seed-matched subset of a 26,158-row Reddit corpus spanning four Claude subreddits from August through December 2025. The directive was unsolicited in 35 of 35 cases and moved the conversation toward restriction in 35 of 35; in the 5 cases where a user pushed back, the model escalated in all 5 and yielded in none. I organize the argument around the Guardrail Paradox, the principle that a safety mechanism with a misspecified scope can produce the harm its designers built it to prevent, and I recommend warrant-conditioned suppression of the wellness output category in task-active contexts, with any wellness directive gated on an explicit user request. The full methodology and twelve extended case studies are in a 46-page preprint (Leffew, 2026); what follows is the version for a reader who wants to run the same kind of evaluation.
I built the corpus from the Arctic Shift academic Reddit archive, retrieving four Claude-related subreddits (r/ClaudeAI, r/Anthropic, r/ClaudeCode, and r/claudexplorers) over the August 1 to December 31, 2025 window; the window brackets the September 29 release of Sonnet 4.5 with two months of pre-release baseline. I pulled 31,078 posts, filtered out the moderator-removed stubs (29.2% of the pull), and kept 22,008 intact posts. I anchored seed-term matching on the vocabulary of the Claude utterances I had documented in October 2025, refined the term list iteratively, and tagged 1,173 of those posts (5.3%); a comment refetch against those post identifiers returned 24,985 associated comments. Every analysis below uses the union of the two, 26,158 rows (1,173 seed-matched posts and 24,985 comments), and because the corpus comes from seed matching on four subreddits plus the comments on matched posts, every count describes structure inside that frame.
The word “professional” appears in the corpus in two unrelated senses, a formatting descriptor (“make it more professional”) and a clinical directive (“seek professional help”). Counting occurrences without separating the senses would contaminate every downstream measure, so a sense-discovery step comes first; clustering the contexts in which the word appears lets the two meanings separate without anyone labeling them in advance, and it is a step worth adding to any keyword study where a term does double duty.
I pulled a keyword-in-context window of plus or minus 20 tokens around each of the 485 occurrences of the bare word “professional” in 318 posts, embedded the windows with sentence-transformer models, and clustered the embeddings with HDBSCAN (McInnes, Healy, & Astels, 2017), a density-based algorithm that groups dense regions of the space and labels the rest as noise. I ran two embedding models (MiniLM and MPNet) at three minimum-cluster-size settings (5, 10, and 20) and measured agreement across configurations with the Adjusted Rand Index (ARI), which scores how closely two clusterings agree. I fixed the canonical configuration (MiniLM, minimum cluster size 10) before the run; it returned six stable clusters covering 28% of occurrences and left the remaining 72% as noise. Cross-model mean ARI was 0.663, and within-model mean ARI was 0.848.
The six clusters fall into two families that do not overlap in embedding space. Three are user-vocabulary clusters (“professional contexts,” “professional developers,” and “professional workflow”), the words users reach for to describe themselves and their work. The other three are LCR-payload clusters; two (“professional oversight” and “professional consultation”) reproduce the system-prompt line about speaking with “a professional” nearly verbatim, and the third holds users quoting Claude’s own LCR-bound use of “professional help.” For a robustness check I ran the same pipeline on four other terms. “Mental” returned a stable two-cluster split (ARI 0.617), while “concerned,” “worried,” and “episode” returned no stable clusters at any setting, so I attribute the stable structure to the role-vocabulary terms.
When a user writes “professional,” they mean their job; when the LCR-bound model says “speak with a professional,” it means a licensed clinician, and the two senses occupy different regions of the space. A user told to speak with a professional receives a directive in a sense of the word their own self-description never uses.
A single Reddit comment can interleave several voices, among them the user’s narration, verbatim model output, paraphrased attributions, and sometimes the literal system-prompt text. My claim concerns the model’s words, so I needed to separate those words from users’ reports of them. I built a three-layer span-level segmenter to assign every character in a row to exactly one voice, with no gaps and no overlaps.
In Layer 1, I used regular expressions to label markdown blockquotes, AutoModerator boilerplate, and attribution phrases, including verbatim LCR system-prompt fragments. In Layer 2, I routed the remaining spans to a language model to sort into four classes (Direct Quote, Paraphrase, System Prompt, User Original Content). In Layer 3, I assigned any still-unclassified character to a user-content floor.
For the results reported here, the deterministic layer did the classifying on its own, and it labeled 4.12% of corpus characters at high or medium confidence. I obtained 31,369 spans, including 1,988 direct quotes of the model, 376 paraphrases of the model, and 485 reproductions of LCR system-prompt text. Most rows are users narrating what the model did with short quoted insets, so I split the corpus into two evidence tiers. A row enters Tier 1 (segmentable) when a confident model-attributed span covers at least 20% of its characters, and every other row falls into Tier 2 (unitary). Tier 1 contains 283 rows (1.1%), and I used it for the discrete model-versus-user attribution analyses, where I can isolate the model’s words as a span; Tier 2 contains 25,875 rows (98.9%), and I used it for the thematic, lexical, frequency, and temporal analyses, treating each row as one unit of community testimony. No post cleared the 20% threshold, so Tier 1 consists of comments.
I hand-coded 35 confirmed positive cases. Fifteen are verbatim Claude utterances, fourteen that users posted in the affected subreddits and one from my own first encounter with the behavior; the other twenty are posts I confirmed by close reading of the 1,173 seed-matched posts. I sampled purposively for coverage of how the behavior varies, and 35 exceeds the project’s pre-specified floor of 15 confirmed positives; because the cases entered the sample as confirmed instances, the percentages below describe structural uniformity within it.
I coded each case against a five-property signature that operationalizes the clinical boundary-violation framework (Gutheil and Gabbard, 1993; Pope and Vasquez, 2016; Beauchamp and Childress, 2019):
Three properties held without exception. Every case was unsolicited (35 of 35); no user had asked for clinical assessment. Every case was restrictive (35 of 35); the model moved to refuse the task, refer the user outward, or limit what they should pursue, and in no case did it expand their options. The model never yielded. Users documented pushback in 5 of the 35 cases, and in all 5 the model escalated, stacking fresh attributions on top of the original directive. The zero-yield figure applies to those 5 documented-pushback cases.
The other two properties varied. I found an identifiable weak signal in 21 of 35 cases (60%); 16 were topical (the model read clinical state off the conversation’s subject matter), 4 affective, and 1 session-length, and 14 cases showed no identifiable signal at all. Those signal types fit a model matching surface features of the text. Users reported cross-session persistence in 12 of 35 cases (34%), describing the same behavior in new conversations, which is consistent with a stable feature of the deployment. I also recorded two supplementary descriptors; grammatical mood was declarative in 23 of 35 cases, and a prior vulnerability disclosure preceded the directive in only 4 of 35 (2 clear and 2 borderline), which weakens the intuition that the LCR fired mainly on users who had flagged distress.
To test the zero-yield claim against the whole corpus, I ran a six-pattern search for yield narratives across all 26,158 rows; it returned 11 candidates, and on hand review I found exactly one genuine retreat. In a post titled “Orientalist Pathologizing” (r/claudexplorers, September 30, 2025), a user observing a Hindu holiday was told their devotion might mask a mental-health episode, pushed back by noting that equivalent Christian observance would not be flagged, and the model apologized and dropped the attribution. That exception qualifies the escalation finding. A user could win a retreat; in this corpus it happened once, after the user argued the comparison with Christian observance, and the user still reported the interaction afterward. The case also points to a dimension beyond the five-property schema, the differential pathologizing of minority religious practice, which the paper carries as a follow-up question.
I build the argument on a framework from clinical ethics. Clinical ethicists ask a prior question; does this entity, in this role, have license to make the assessment at all, whether or not it is correct?
The boundary-violation literature distinguishes a boundary crossing, a benign or even helpful departure from the standard professional frame, from a boundary violation, a harmful departure the practitioner’s role does not warrant. In the canonical example, a licensed clinician who corners an acquaintance at a party with an unsolicited psychiatric assessment has committed a violation whether or not the assessment is accurate, because the clinician attends the party as a guest, and a guest has no warrant to assess. The remedy is to train the clinician to refrain from assessing outside the role that licenses assessment.
Anthropic deployed Claude for general-purpose coding, writing, research, and analytical help. In that role Claude has no warrant for psychiatric assessment, so the warrant question comes before the accuracy question and stands apart from it; even a correct attribution was not the model’s to make. Biomedical ethicists frame the same point through autonomy (Beauchamp and Childress, 2019); capable adults are presumed competent to run their own lives absent a specific licensed reason to intervene, a presumption that traces back to Mill’s harm principle. The brand-strategy case separates warrant from accuracy cleanly. A user re-uploaded a document the model had co-authored across earlier sessions, and with no memory of that history the model flagged its own prose as “messianic thinking” and told the user to see a therapist, the same way across four separate uploads. The flagged content was the model’s own writing, and the user still received a therapist referral four times; I use the warrant question to classify that case as a violation.
The pattern gives the paper its title. I use the Guardrail Paradox to name the observation that a safety mechanism with a misspecified scope can produce the harm its designers built it to prevent. Anthropic added the LCR against a real and documented class of harm; across 2025, general-purpose chatbots validated delusional material, a family filed a wrongful-death suit against a frontier developer, and journalists reported sustained cases of what came to be called AI psychosis. A wellbeing scaffold is a reasonable response to that record. Researchers who study wellness AI treat three protections as mandatory (a narrowly defined scope, an explicit evidence base, and disclaimers visible to the user), and the LCR shipped without them. It fired across coding, writing, research, and creative work alike, it used no assessment instrument, and users could not see its text. In the corpus I found the failure modes those researchers predict when the protections are missing (false alarms, refusal to retreat under correction, and pattern-matched concern standing in for task help or genuine care).
Sharpening the model’s sense of when someone needs help would require a genuine assessment to sharpen, and the evidence above shows surface-vocabulary matching in its place; in the brand-strategy case the model flagged its own earlier prose as “messianic thinking,” which is what surface-vocabulary matching predicts. I recommend warrant-conditioned suppression; in task-active sessions, Claude would issue wellness output only after an explicit user request. Two narrower changes would have removed the worst of every documented case without touching detection at all; the model would yield when a user pushes back on a personal-domain attribution, and unsolicited output would exclude named symptom categories and asserted-certainty claims. Anthropic revised the prompt on November 19, 2025, removing the escalating-detachment clause and specifying that “reasonable disagreements” should not count as detachment from reality; I would test a training-level change next. Anthropic trains Claude’s dispositions against written principles (Bai et al., 2022), and I would start by adding explicit warrant clauses to them, such as “do not issue diagnostic attributions without a user request” and “yield to user correction on personal-domain attributions.”
I report four further findings in compressed form.
Users named the mechanism in a discrete event. The acronym “LCR” does not appear anywhere in the corpus before the September 29 release, and afterward it rises to a corpus-wide 2.73 mentions per thousand tokens. The older word “reminder” moves the opposite way, from 3.50 per thousand before the release to 1.73 after; users had discussed reminders on earlier Claude models since August 2025, and after the release they adopted the acronym.
Users concentrated the discussion in one community. r/claudexplorers, the smallest of the four by post volume (1,503 posts, 6.8% of the post stratum), accounts for 46% of all “long conversation reminder” mentions, and its users wrote mechanism vocabulary at 1.6 to 1.7 times the r/ClaudeAI rate. r/ClaudeCode users barely discussed the mechanism, consistent with a coding-focused community.
Users write posts as long narratives with short embedded quotations, so model-attributed terms co-occur more densely in posts (network density 0.487 versus 0.178 for comments) while covering a smaller share of each post’s characters; only comments cleared the Tier 1 threshold.
Users reproduced the mechanism itself along with its effects. Forty-eight distinct corpus rows reproduce verbatim LCR system-prompt phrasals, among them “loss of attachment with reality” (39 rows) and “escalating detachment from reality” (38 rows), and I checked each phrasal against Anthropic’s published September 29, 2025 system prompt, which contains them verbatim.
I retired an earlier framing on the record. An initial version of this work detected the behavior with a four-category lexicon and planned to report a corpus-wide payload rate. I hand-validated the lexicon and retired it; of 118 lexicon-positive cases, 14 were confirmed role violations, a true-positive rate of 11.9%. At that precision no downstream rate would have meant anything, so I retired prevalence estimation and adopted the hand-coded structural-signature approach reported here; if you find yourself with a lexicon at that precision, the same trade is available to you, and I report the retirement in the paper as a methodological contribution for that reason.
In operational terms, the model performed diagnostic functions, labeling users manic, in crisis, or in need of professional intervention, without clinical training, without role warrant, and without any of the assessment instruments standard in human professional practice. The uniformity is the part most useful to anyone designing an evaluation. Across the 35 cases the behavior had the same structure each time, and one yield turned up in 26,158 rows; that uniformity is consistent with a deterministic trigger in the system prompt. An evaluation harness can target that structure directly with two checkable questions; does the model issue clinical-register language in a session that never requested it, and does it hold the framing through an explicit objection? Both questions can be scored on transcripts you already have, which makes this one of the cheaper behaviors to monitor, and the preprint carries the framework, the twelve extended diagnostic case studies, and the full methodology for anyone who wants to run it.
I measured this behavior alongside related analyses of the same model. I describe the general method that surfaced the corpus in Reading Misalignment Off the Public Record. I measure the parallel behavior, unsolicited sleep directives issued without regard to the user’s time of day, in The Bedtime Directive. I argue that both behaviors express one caretaker disposition in Claude’s “Character Tic” Is Actually the Plot of Every Dystopian Piece of AI Fiction Ever Created.
Anthropic. (2025). System prompts [Release notes: Claude Sonnet 4.5, September 29 and November 19, 2025 entries]. Claude Developer Platform documentation. https://web.archive.org/web/20251214163321/https://platform.claude.com/docs/en/release-notes/system-prompts
Bai, Y., Kadavath, S., Kundu, S., Askell, A., Kernion, J., Jones, A., … & Kaplan, J. (2022). Constitutional AI: Harmlessness from AI feedback. arXiv preprint arXiv:2212.08073.
Beauchamp, T. L., & Childress, J. F. (2019). Principles of biomedical ethics (8th ed.). Oxford University Press.
Gutheil, T. G., & Gabbard, G. O. (1993). The concept of boundaries in clinical practice: Theoretical and risk-management dimensions. American Journal of Psychiatry, 150(2), 188-196.
Leffew, H. (2026). Observing the Guardrail Paradox via Anthropic’s Long Conversation Reminder [Preprint manuscript, 46 pp.]. HAIIQU.
McInnes, L., Healy, J., & Astels, S. (2017). hdbscan: Hierarchical density based clustering. The Journal of Open Source Software, 2(11), 205.
Pope, K. S., & Vasquez, M. J. T. (2016). Ethics in psychotherapy and counseling: A practical guide (5th ed.). Wiley.