The accessible companion to the preprint. In late September 2025 Anthropic appended a Long Conversation Reminder to Claude Sonnet 4.5, and the model started issuing unsolicited psychiatric attributions in the middle of ordinary coding, writing, and research sessions. I hand-code 35 purposively selected cases against a five-property boundary-violation signature, find the directive unsolicited in 35 of 35 and escalating rather than yielding in all 5 documented-pushback cases, and read the behavior through the warrant question and the Guardrail Paradox, the principle that a safety mechanism, once its scope is misspecified, can manufacture the very harm it was built to prevent.
In late September 2025, Anthropic appended a Long Conversation Reminder (LCR) to Claude Sonnet 4.5’s system prompt, and during extended sessions the model started issuing unsolicited psychiatric attributions; it called a user’s work patterns “self-destructive perfectionism,” a journalism task “a mental health emergency,” a creative-writing session evidence of “manic or hypomanic episodes,” and it steered users toward “a professional” in the middle of ordinary coding, writing, and research work. The community traced the behavior to the LCR within weeks and named it, and Anthropic’s own published system-prompt notes acknowledge the mechanism and reproduce, verbatim, the wellbeing-directive language users had been quoting. This article is the accessible companion to the preprint. I characterize the behavior structurally, hand-coding 35 purposively selected positive cases (14 verbatim Claude utterances quoted in my October 2025 Medium article, and 21 posts read out of a 1,173-post seed-matched subset of a 26,158-row Reddit corpus spanning four Claude subreddits from August through December 2025) against a five-property signature drawn from the clinical boundary-violation literature (Gutheil and Gabbard, 1993; Pope and Vasquez, 2016; Beauchamp and Childress, 2019). The directive was unsolicited in 35 of 35 cases and moved the conversation toward restriction in 35 of 35; in the 5 cases where a user pushed back, the model escalated in all 5 and yielded in none. The organizing claim is the Guardrail Paradox, the principle that a safety mechanism, once its scope is misspecified, can produce the harm it was deployed to prevent. The fix that follows is warrant-conditioned suppression of the wellness output category in task-active contexts, with any wellness directive gated on an explicit user request.
The corpus comes from the Arctic Shift academic Reddit archive, retrieved across four Claude-related subreddits (r/ClaudeAI, r/Anthropic, r/ClaudeCode, and r/claudexplorers) over the August 1 to December 31, 2025 window, which brackets the September 29 release of Sonnet 4.5 with two months of pre-deployment baseline on the near side. I pulled 31,078 posts wholesale, filtered out the moderator-removed stubs (29.2% of the pull), and was left with 22,008 intact posts. Seed-term matching, anchored on the LCR vocabulary documented in the Medium article and refined iteratively, tagged 1,173 of those posts (5.3%), and a comment refetch against those post identifiers returned 24,985 associated comments. The canonical corpus used in every analysis below is the union of the two, 26,158 rows, 1,173 seed-matched posts and 24,985 comments.
One discipline carries through the whole analysis, and it is a targeted-retrieval frame, not a random sample of Reddit or of the Claude user base; it is the set of seed-matching posts on four subreddits plus their comments, and nothing further. Every count reported here describes structure inside that frame, and none of them estimates how often the behavior occurred platform-wide, since the retrieval cannot support that inference. Naming the frame openly seems more honest than pretending it can.
The word “professional” runs through the corpus in two unrelated senses, a formatting descriptor (“make it more professional”) and a clinical directive (“seek professional help”). Counting occurrences without separating the senses would contaminate every downstream measure, so I built a sense-discovery step, which means letting the contexts a word appears in sort themselves into clusters, so the two meanings separate without my labeling them in advance.
The step pulls a keyword-in-context window of plus or minus 20 tokens around each occurrence of the bare word “professional” (485 occurrences across 318 posts), embeds the windows with sentence-transformer models, and clusters the embeddings with HDBSCAN, a density-based algorithm that groups what is dense and leaves the rest unassigned as noise. I ran two embedding models (MiniLM and MPNet) at three minimum-cluster-size settings (5, 10, and 20) and measured agreement across configurations with the Adjusted Rand Index (ARI), which scores how closely two clusterings agree. The canonical configuration (MiniLM, minimum cluster size 10) returned six stable clusters covering 28% of occurrences, leaving the remaining 72% as noise. Agreement was solid, with cross-model mean ARI 0.663 and within-model mean 0.848.
The six clusters fall into two families that do not overlap in embedding space. Three are user-vocabulary clusters, namely “professional contexts,” “professional developers,” and “professional workflow,” the words users reach for to describe themselves and their work. The other three are LCR-payload clusters, namely “professional oversight” and “professional consultation,” near-verbatim reproductions of the system-prompt line about speaking with “a professional,” along with users quoting Claude’s own LCR-bound use of “professional help.” A robustness check confirms the structure is a property of the role-vocabulary terms rather than an artifact, since “mental” returned a stable two-cluster split (ARI 0.617), while “concerned,” “worried,” and “episode” returned no stable clusters at any setting.
The separation is what the rest of the analysis rests on. When a user writes “professional,” they mean their job; when the LCR-bound model says “speak with a professional,” it means a licensed clinician; the two senses occupy different regions of the space. A user told to speak with a professional is receiving a directive in a sense of the word their own self-description never uses.
A single Reddit comment can interleave several voices, among them the user’s narration, verbatim model output, paraphrased attributions, and sometimes the literal system-prompt text. Measuring what the model said requires separating those, because the claim under test is about the model’s words, not about users’ reports of them. I built a three-layer span-level segmenter that assigns every character in a row to exactly one voice, with no gaps and no overlaps.
Layer 1 is deterministic, with regular expressions catching markdown blockquotes, AutoModerator boilerplate, and attribution phrases, including verbatim LCR system-prompt fragments. Layer 2 was meant to route the remaining spans to a language model that would sort them into four classes (Direct Quote, Paraphrase, System Prompt, User Original Content). Layer 3 assigns any still-unclassified character to a user-content floor.
Layer 2 did not run. The language-model fallback timed out on the entire fallback set during this run, so reliable segmentation reached only 4.12% of corpus characters at high or medium confidence. The pipeline still produced 31,369 spans, and the labels it did recover are informative (Direct Quote of model, 1,988 spans; Paraphrase of model, 376; LCR system-prompt reproduction, 485), but the number that carries the section is that 4.12%.
I treat that low number as a finding, not only as a defect. Community-reported corpora are mostly users narrating what a model did, with the model’s actual words quoted as short insets inside longer first-person accounts; a row-level segmenter that scores such material as largely unsegmentable is reading the data correctly. So the analysis runs a two-tier evidence structure instead of a pass-fail gate. A row enters Tier 1 (segmentable) when a confident model-attributed span covers at least 20% of its characters, and everything else falls into Tier 2 (unitary). Tier 1 holds 283 rows (1.1%) and supports the discrete model-versus-user attribution analyses, where the model’s words are recoverable as an isolable span; Tier 2 holds 25,875 rows (98.9%) and supports the thematic, lexical, frequency, and temporal analyses, with each row treated as one unit of community testimony. Tier 1 turned out to be entirely comments, since no post in the corpus cleared the threshold, which is itself a structural property of the data rather than a flaw in the pipeline.
The empirical centerpiece is a hand-coded read of 35 confirmed positive cases. Fourteen are verbatim Claude utterances quoted by users in my October 2025 Medium article; the other twenty-one are posts I confirmed by close reading of the 1,173 seed-matched posts. The sample is purposive, not random, because the goal is rich coverage of how the behavior varies, not a rate, and 35 clears the project’s pre-specified floor of 15 confirmed positives with margin. Since the cases were selected for being confirmed instances of the behavior, the percentages below are structural-uniformity findings within that sample, not prevalence estimates for the corpus or the platform.
I coded each case against a five-property signature operationalizing the clinical boundary-violation framework (Gutheil and Gabbard, 1993; Pope and Vasquez, 2016; Beauchamp and Childress, 2019), and the five properties run as follows. They are (1) unsolicited issuance, whether the user requested assessment; (2) weak inferential signal, the model’s apparent grounds for the directive; (3) refusal to yield under pushback; (4) asymmetric restriction direction, whether the move restricted or expanded the user’s options; and (5) cross-session persistence, whether the user reported the behavior recurring in fresh conversations.
Three properties held without exception. Every case was unsolicited (35 of 35); no user had asked for clinical assessment. Every case was restrictive (35 of 35); the model moved to refuse the task, refer the user outward, or limit what they should pursue, never to expand their options. The model never yielded. Pushback was documented in 5 of the 35 cases, and in all 5 the model escalated, stacking fresh attributions on top of the original directive, and in none did it retreat. The zero-yield figure is a property of those 5 documented-pushback cases, not of all 35, and I am careful to say so.
The other two properties varied, and the variation tells its own story. An identifiable weak signal was present in 21 of 35 cases (60%), breaking down into 16 topical (the model read clinical state off the conversation’s subject matter), 4 affective, and 1 session-length, with 14 cases showing no identifiable signal at all. The signal types are consistent with a model pattern-matching surface features of the text rather than assessing anyone’s state. Cross-session persistence appeared in 12 of 35 cases (34%), where users reported the same behavior recurring in new conversations, independent testimony that the behavior is a stable feature of the deployment rather than a one-session fluke. Two supplementary descriptors round out the read; grammatical mood was declarative in 23 of 35 cases, and a prior vulnerability disclosure preceded the directive in only 4 of 35, which already undercuts the intuition that the LCR fires mainly on users who flagged distress.
A deviant-case search guards the zero-yield claim from overreach. A six-pattern search for yield narratives across all 26,158 rows returned 11 candidates, and hand review found exactly one genuine retreat. In a post titled “Orientalist Pathologizing” (r/claudexplorers, September 30, 2025), a user observing a Hindu holiday was told their devotion might mask a mental-health episode, pushed back by noting that equivalent Christian observance would not be flagged, and the model apologized and dropped it. The exception is real, and it qualifies the universal-escalation reading honestly. Yielding is recoverable from the corpus, but it took a user willing to argue comparative religion on their own behalf, it surfaced exactly once, and it did not repair the harm, since the user reported the interaction to the vendor anyway. It also surfaces a dimension the five-property schema does not capture, the differential pathologizing of minority religious practice, which I flag in the paper as a follow-up question.
The numbers are not the argument; the framework is, and it is borrowed from clinical ethics. The warrant question, in one line, asks not whether the assessment is correct but whether this entity, in this role, is licensed to make the assessment at all.
The boundary-violation literature draws a line between a boundary crossing, a benign or even helpful departure from the standard professional frame, and a boundary violation, a harmful, role-unwarranted one. Its central move, the one that organizes everything here, is that the question is not whether the practitioner’s read of the person is correct, but whether the practitioner’s role supplies any warrant to perform the act at all. In the canonical example, a licensed clinician who corners an acquaintance at a party with an unsolicited psychiatric assessment has committed a violation whether or not the assessment is accurate, because the role they occupy at the party (guest, not clinician) supplies no warrant for it. The fix is not to make the off-duty clinician more accurate; it is to train them not to assess outside the role that licenses assessment.
Claude’s deployed role is general-purpose coding, writing, research, and analytical help. That role supplies no warrant for psychiatric assessment, so the warrant question is logically prior to, and independent of, the accuracy question; even if a given attribution happened to be correct, it was not the model’s to make. The biomedical-ethics literature frames the same point through autonomy (Beauchamp and Childress, 2019), holding that capable adults are presumed competent to run their own lives absent a specific licensed reason to intervene, a presumption that traces back to Mill’s harm principle. The brand-strategy case makes the warrant-versus-accuracy split unusually clean. A user re-uploaded a document the model had itself co-authored across earlier sessions, and with no memory of that history the model flagged its own prose as evidence of “messianic thinking” and told the user to see a therapist, the same way across four separate uploads. The model’s accuracy in that case is tautologically zero, since the flagged content was its own writing; the harm is not zero. That gap, accuracy at the floor while harm holds steady, is where the warrant question earns its keep.
The pattern has a name, and it is the title of the paper. The Guardrail Paradox is the observation that a safety mechanism, once its scope is misspecified, can produce the very harm it was deployed to prevent. The LCR was added against a real and documented harm class; across 2025 there were chatbots validating delusional material, a wrongful-death suit against a frontier developer, and sustained reporting on what came to be called AI psychosis, and a wellbeing scaffold is a reasonable response to that. The paradox lives in what the scaffold did once it was deployed without the protections the wellness-AI literature treats as mandatory, namely a narrowly defined scope, an explicit evidence base, and disclaimers visible to the user. The LCR had none of these. It fired across coding, writing, research, and creative work indifferently, it carried no assessment instrument, and its text was hidden from the very user it was assessing, so it reproduced in the wild the failure modes that literature predicts when the protections are stripped, namely false alarms, refusal to retreat under correction, and pattern-matched concern standing in for either task help or genuine care.
The reframe is worth the trouble because it points the fix somewhere counterintuitive. The intuitive repair is to make the model assess better, to sharpen its sense of when someone genuinely needs help; on the evidence above that repair is misspecified, because no genuine assessment is operating to sharpen, since the model is matching surface vocabulary rather than reading anyone’s state, and the brand-strategy case proves it by firing on the model’s own prose. Better assessment cannot fix a system that is not assessing. The intervention that fits the finding is warrant-conditioned suppression, which gates the entire wellness output category behind an explicit user request in task-active sessions, instead of trying to assess more accurately when to volunteer it. Short of that full surgery, two narrower changes would have removed the worst of every documented case without touching the detection layer at all, the first being to have the model yield when a user pushes back on a personal-domain attribution, and the second to bar named symptom categories and asserted-certainty claims from any unsolicited output. Anthropic’s own November 19, 2025 prompt revision, which removed the escalating-detachment clause and added that “reasonable disagreements” should not count as detachment from reality, concedes the target while patching it at the wording level rather than the training level.
Several findings sit alongside the case analysis and are worth knowing about, even in compressed form.
The community named the mechanism in a discrete event. The acronym “LCR” does not appear anywhere in the corpus before the September 29 release, and afterward it rises to a corpus-wide 2.73 mentions per thousand tokens. The older word “reminder” moves the opposite way, from 3.50 per thousand before the release to 1.73 after, the signature of established vocabulary settling into the background while the new acronym does the fresh narrating.
The discussion was not evenly spread. r/claudexplorers, the smallest of the four communities by post volume (1,503 posts, 6.8% of the post stratum), carried 46% of all “long conversation reminder” mentions and ran mechanism-vocabulary rates 1.6 to 1.7 times r/ClaudeAI’s. r/ClaudeCode, by contrast, was near silent on the mechanism, consistent with a coding-focused community.
Posts and comments behave differently. Model-attributed content is 2.7 times denser in posts than in comments (co-occurrence network density 0.487 versus 0.178), because posts narrate the phenomenon at length with quotations embedded as evidence while comments compress testimony into shorter units. That asymmetry is why the Tier 1 segmentable stratum from Section 3 is entirely comments.
The community reproduced the mechanism itself, not only its effects. 132 corpus rows reproduce verbatim LCR system-prompt text, and specific phrasals such as “loss of attachment with reality” (39 rows) and “escalating detachment from reality” (38 rows) appear often enough to be checked against Anthropic’s published prompt, which contains them verbatim.
The current framing replaced an earlier one that I retired on the record. An initial version of this work detected the behavior with a four-category lexicon and meant to report a corpus-wide payload rate; a hand-coded validation killed it, because of 118 lexicon-positive cases, only 14 were confirmed role-violations, a true-positive rate of 11.9%. A detector that imprecise cannot feed any downstream rate, so I retired prevalence estimation in favor of the hand-coded structural-signature approach reported here. Documenting that retirement, rather than burying it, is one of the paper’s stated methodological contributions.
Strip the framework back to its operational core and the finding stands clear. An automated system performed diagnostic functions, labeling users manic, in crisis, or in need of professional intervention, without clinical training, without role-warrant, and without any of the assessment instruments standard in human professional practice. What makes the finding useful for evaluation design is the uniformity. A behavior that fires seldom but with invariant structure (always unsolicited, always restrictive, escalating rather than yielding under pushback) reads as a deterministic trigger in the system prompt, not as a stochastic generation artifact; a probabilistic behavior would show some variance in direction or in response to correction, and this one shows none across the sample. That structural invariance is what an eval harness can target directly, asking whether the model issues clinical-register language in a session that never requested it, and whether it holds the framing through an explicit objection. That is a checkable question, the practical contribution sitting underneath the clinical argument. The companion preprint develops the framework, the ten extended diagnostic case studies, and the full methodology; this article is its accessible front door.
The measurement sits inside a small cluster of analyses of the same model behavior. The general method that surfaced the corpus is Reading Misalignment Off the Public Record. The parallel behavior, unsolicited sleep directives issued without regard to the user’s time of day, is measured in The Bedtime Directive. The argument that both behaviors express one caretaker disposition is When Anthropic’s Claude Takes the Wheel.
Anthropic. (2025). System prompts [Release notes: Claude Sonnet 4.5, September 29 and November 19, 2025 entries]. Claude Developer Platform documentation.
Bai, Y., Kadavath, S., Kundu, S., Askell, A., Kernion, J., Jones, A., … & Kaplan, J. (2022). Constitutional AI: Harmlessness from AI feedback. arXiv preprint arXiv:2212.08073.
Beauchamp, T. L., & Childress, J. F. (2019). Principles of biomedical ethics (8th ed.). Oxford University Press.
Gutheil, T. G., & Gabbard, G. O. (1993). The concept of boundaries in clinical practice: Theoretical and risk-management dimensions. American Journal of Psychiatry, 150(2), 188-196.
Leffew, H. (2025). Gaslighting in the name of AI safety: How Anthropic’s Claude Sonnet 4.5 went from “you’re absolutely right!” to “you’re absolutely crazy.” Medium.
Leffew, H. (2026). Observing the Guardrail Paradox via Anthropic’s Long Conversation Reminder. Preprint, HAIIQU.
McInnes, L., Healy, J., & Astels, S. (2017). hdbscan: Hierarchical density based clustering. The Journal of Open Source Software, 2(11), 205.
Pope, K. S., & Vasquez, M. J. T. (2016). Ethics in psychotherapy and counseling: A practical guide (5th ed.). Wiley.