Are we entering a new era of censored code generation?

Graphic pictures and malicious hacking were already off limits. A coding model refusing the program itself is the step that had not happened.

Coding models have refused requests for years. The refusals had a shape. They stopped a kind of picture, or a kind of attack. They did not stop a kind of application. Claude Code's new censoring trend is the first widely confirmed case of the third shape from a major lab: two sentences in Claude Code, on Opus 5.5, steered the agent away from rebuilding someone else's specific game.

Pictures had a filter first

Image models learned this lesson in public. OpenAI's notes on native image generation say that violence in an artistic, fictional, or creative context is generally allowed, and that the system is built to stop photorealistic, graphically violent imagery in certain contexts. Child sexual abuse material is blocked on the prompt and on the output. The filter sits on a picture. The surrounding product, the editor, the gallery, the app that displays the image, is still something you can ask the model to build.

That boundary is old enough to feel like part of the tool. People argue about where the line sits, and labs have moved it, but nobody is surprised that an image model says no to a graphic picture. The refusal is the product working as advertised.

Malicious hacking had a filter next

Coding models drew a second line, on attacks. The accurate name for what used to get called a style of hacking is unauthorized intrusion and malware. Anthropic's usage policy forbids discovering or exploiting vulnerabilities without the system owner's authorization, gaining unauthorized access, and creating or distributing malware, ransomware, or other malicious code. The same section says it does not forbid security research on systems you own, on systems you are allowed to test, or inside an authorized bug-bounty program. Some of that work is pointed at a Cyber Verification Program when it runs into the model's real-time safeguards.

That ban is about a method. The model can still write the application. It is supposed to stop when the application is the attack: the exploit, the malware, the unauthorized access. A game, a storefront, a design tool, a todo app: those requests were on the allowed side of this line, because the harm was not in the category of software.

The new refusal is the product

The Claude Code instruction does something else. It says to build original games, games in a genre, and games from the user's own designs and assets, and to refuse a recreation of a specific existing game even if the user renames it or calls it original. A platformer is ordinary software. The refusal depends on whose software the request resembles.

That is why it landed on developers who were not trying to ship a copy. Naming a game is how people describe mechanics. Addy Osmani, confirming the rule and then the fix, said the first wording was also firing when someone referenced a game only to describe the feel they wanted. Claude Code 2.1.317, shipped in the first days of November, is supposed to treat that reference as a genre and answer with an original. A request for the copy itself is supposed to come back as an offer to build something similar.

Source: Gemini CLI documentation, Google.

A prompt diff of 2.1.317, captured outside Anthropic, draws the protected list in concrete nouns: the name, the characters, the art, the music, the levels, the look. Mechanics are handed back. If that capture matches what shipped, the line is "do not counterfeit the shipped game." That is closer to a copyright steer than to a ban on making games. It is still a content rule inside the coding agent, and it was pushed live before it was written into the public changelog.

Why a product filter travels

A graphic-image filter stays put because the harm is the picture. A malware filter stays put because the harm is the attack. A product filter moves. Games produced this sentence after a season of AI remakes, and after studios such as Digital Sun pulled a public playtest of ReVamp rather than hand a demo to a cloner, as Game Developer reported. The same sentence structure fits the next catalog. Do not recreate a specific existing design tool. Do not recreate a specific existing storefront. Do not recreate a specific existing mobile app, even renamed. Nothing in the 2.1.317 wording does that today. The mechanism that would carry it is already how Claude Code ships prompt changes: a short instruction, delivered to the model, with no user switch.

Open-weight models and local runners do not have to carry the sentence. Game Developer noted the obvious exit. If Claude becomes awkward for the person building the clone, that person changes models. The same exit exists for the developer whose legitimate spec got caught. A lab that wants both the studios' trust and the developer's session has to keep the refusal on the counterfeit, and off the genre reference. Anthropic needed a public correction to get there. That correction is the precedent. The next fight is whether the other labs copy the first wording, the revised wording, or neither, and let the model improvise. That is whether OpenAI and Gemini censor code too.

ThinkReview reviews the diff the model produced, on GitHub, GitLab, Azure DevOps, and Bitbucket. Which model is allowed to produce it is a setting in Model selection. A refusal policy now comes with that setting.