I was banned from Claude for scaffolding a CLAUDE.md file

{{IMAGE:1}}

The Ban Hammer Falls

One minute I'm a €220/month "Max 20x" AI "power user" (is this even a thing?). The next, I am a disabled non-person "organization". Like a lot of my peers I was using claude code CLI regularly and trying to understand how far I could go with it on my personal projects. Going wild, with ideas and approaches to code I can now try and validate at a very fast pace. Run it inside tmux and let it do the work while I went on to do something else. Until in one of these sessions I got presented with that response.

API Error: 400 { "error": { "type": "invalid_request_error", "message":"This organization has been disabled." }, ... }

If you are automating prompts that look like system instructions (i.e. scaffolding context files, or using Claude to find errors of another Claude and iterate on its CLAUDE.md, or etc...), you are walking on a minefield.

The Setup: A Three-Character Drama

To help understand this, there are three main characters in this story:

• Claude A: an instance of claude in a tmux pane
• Claude B: another instance in another tmux pane
• A disabled organization: me

The loop was like this:

1. The disabled organization (me) asked Claude A to update the scaffold tool with a cool CLAUDE.md
2. I went on and started a new project with the tool, opened a claude in there (Claude B) and asked for a complex task to be done
3. Whenever Claude B made a mistake, I would go to Claude A, paste the error, and say something like "hey, Claude B made this error"
4. goto 1

Running two instances of claudes, while one updated the CLAUDE.md of another as it made mistakes. The loop repeated until I was told I was a disabled organization. Banned!

The Technical Reality: Boring Project Scaffolding

I just wanted a standard context file for new projects. At one point Claude A got somewhat annoyed with Claude B, and started shoutting! writting in en-US instead of en-GB, that is: ALL CAPS. I went on to check the file, and it was getting littered with these kind of instructions to make Claude B do something instead of what it would try to do.

My guess is that this likely tripped the "Prompt Injection" heuristics that the non-disabled organization has. I would love to see the face of that AI when it saw its own "system prompt" language being echoed back to it. Or I don't know. This is all just a guess from me.

The quine is the quine. I was playing like a "human-in-the-loop" middleware for these LLM tools. Like watching one instance of Claude try to "boss around" another instance of itself, and the platform's security guards mistook it for a riot.

{{IMAGE:2}}

The Communication Black Hole

So I went running to read their docs. What was going on here? Made an appeal, which was a link to a google docs form, with a textbox where I tried to convince some Claude C in the multi-trillion-quadrillion dollar non-disabled organization that I was not only a human but also a well-intended one. I got no reply. Not even an automatic response. 0 comms.

So I wrote to their support, this time I wrote the text with the help of a LLM from another non-disabled organization. I got no reply. Not even an automatic response. And to wonder that people complain about civil servants, eh, wait until you have to deal with one of these expensive machines!

After a couple of days I got an e-mail: Credit note from Anthropic, PBC for invoice #... Yes, the only e-mail I got was a credit note giving my money back. It's like they're saying "We don't want to talk to you anymore, here is some hush money". But hey guys, it is not a conversation if it is one-way only, and here I am talking to a wall. I didn't even get to have a "It's not you, it's us." I just got a credit note. Ahaha I'm so happy!

I'm glad this happened with this particular non-disabled-organization. Because if this by chance had happened with the other non-disabled-organization that also provides such tools... then I would be out of e-mail, photos, documents, and phone OS.

The Broader Implications

AI moderation is currently a "black box" that prioritizes safety over accuracy to an extreme degree. If you are automating prompts that look like system instructions (i.e. scaffolding context files), you are walking on a minefield.

This incident reveals several critical issues with current AI service models:

1. Opacity in enforcement: No explanation, no dialogue, just termination
2. False positives: Boring project scaffolding flagged as malicious behavior
3. Asymmetric power: Users have no recourse against automated decisions
4. The "organization" trap: Personal accounts treated as corporate entities

Moving Forward

I got my €220 back (ouch that's a lot of money for this kind of service, thanks capitalism). I have reframed the whole scaffolding project, and reverted all the code Claude did there. Soon I will re-release boreDOM with a new angle and approach, without the help of Claude.

I am trying to turn it into a JS framework for LLMs (llm first, or even llm only, it now has no API). To produce and iterate on those single.html files that these tools are now bringing to the world.

If you want to take a look at the CLAUDE.md that Claude A was making Claude B run with, I commited it and it is available here.

Conclusion

Again to wrap this up: this whole post is just my hypothesis. Claude was not doing anything other than iterating on this file at the moment I got the ban. And I haven't heard from them about this anymore (or ever). "you got to understand that these organizations have a lot of users..."

The incident serves as a cautionary tale for developers pushing the boundaries of AI tooling. As we build more sophisticated workflows that involve multiple AI instances interacting with each other, we enter uncharted territory where the rules are unclear and the enforcement is absolute. The line between legitimate automation and system abuse has never been blurrier, and the consequences of crossing it have never been more severe.