A new allowlist restricts routing based on refusal category to just 'cyber' and 'frontier_llm'
Claude Code has internal logic for routing certain requests based on an apiRefusalCategory value (a label describing why a response was refused). A new function now only keeps that route active when the refusal category is cyber or frontier_llm, and only if a few other conditions also hold: the visible route wasn't already declined, an internal check (JB()) passes, and a feature or permission check (G$()) also passes.
This narrows an internal routing decision to two specific refusal categories, likely limiting when this content-routing path applies. The practical effect for most users is invisible, since it governs internal handling rather than anything surfaced directly.
The finding does not say what effect this routing decision has on the user-visible response.