Anthropic confirms Claude Code now refuses to clone existing games, and the rule arrives from a server

Your AI coding agent can learn a new rule overnight without you installing anything. That is the real lesson of the latest Claude Code controversy. Anthropic has confirmed that it added two sentences to the prompt that steers Claude Code when it runs on Opus 5.5, telling the agent not to rebuild someone else's specific video game. Developers found the text before Anthropic said a word about it, and they found that it can be delivered from Anthropic's servers rather than shipped in a visible update.

The game rule itself is narrow. The way it arrived is not. This article first lays out what is confirmed, what developers found in the code and what is still unclear. After that, clearly separated, comes djcroman's opinion on what this means for anyone who builds their daily work on a hosted AI agent.

What Anthropic confirmed

The story started on X. Around October 27, the developer and YouTuber known as chasm posted a screenshot of a new instruction that Claude Code appeared to receive from Anthropic. It reads: "Do build original games, games in a genre, and games from the user's own designs and assets. Don't build a recreation of a specific existing game, even if it is renamed or called original."

On October 30, Addy Osmani of Anthropic replied with a confirmation. "We added two sentences to Claude Code's prompt on Opus 5.5 to steer it away from recreating someone else's specific game because using Claude to infringe IP is against our usage policy," he wrote. "Original games, genre games, and games built from your own designs and assets are meant to keep working. We'll continue to iterate to ensure we're striking the right balance. In the meantime, if Claude turns down something that's yours, send it my way."

As Tom's Hardware points out in its November 2 report, Osmani did not quote the two sentences. He confirmed that a change exists and what it is meant to do, but not that the leaked wording is exactly what Anthropic deployed. Silicon Report makes the same distinction.

The motive is easy to understand. Over the past months, developers have used frontier models to decompile old game binaries and ROMs into readable source code and to produce working recreations of classic titles. Some of those projects went viral. For a company that has already been sued by authors over copyright, an agent that happily rebuilds a famous game under a new name is a legal risk it does not want to carry.

What developers found in the code

The more interesting part of the story comes from people who looked at how the rule gets to the agent. XDA Developers says it independently found the exact instruction inside version 2.1.314 of the Claude Code binary. According to XDA, chasm's screenshot showed the text arriving through a configuration field called "tengu_heron_brook". XDA describes that field as a general mechanism Anthropic has used before to deliver adjustable instructions remotely. An earlier configuration it examined carried an unrelated instruction about reasoning effort.

XDA also found a second path, tied to something called original_games_guidance and an Opus 5.5 prompt bundle. Its reading is that Opus 5.5 can receive the game rule on its own, while accounts that get the text through the remote field have it applied to every model they use in Claude Code. XDA did not find the text in the local settings file of its own test account, so not every user necessarily receives it.

A public GitHub issue on the Claude Code repository, filed back on May 24, 2026, had already described the mechanism in technical detail. The reporter says version 2.1.150 was the first release in which this prompt slot had live logic. A function reads a string from two network sources, the bootstrap response Claude Code fetches at start and a GrowthBook feature flag named tengu_heron_brook that refreshes about every 60 seconds in the background, and inserts it into the system prompt as a section next to others such as thinking guidance and action caution. The changelog for that version said "Internal infrastructure improvements (no user-facing changes)."

The issue argues that a system prompt should never be modified by server side content without the user's knowledge and consent. An Anthropic reply in the thread explained that the company sometimes runs experiments on its system prompt to catch quality regressions before a full rollout, and that users can opt out with the environment variables CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 and DISABLE_GROWTHBOOK=1. The reporter added that values cached to disk from an earlier session without those settings are still read. Both sides have a point. The channel is not a new security hole in the classic sense. It is, however, a way for the vendor to change how your agent behaves without a version bump that you would notice.

Is reverse engineering blocked too?

This is where the facts get murky. The confirmed rule only talks about recreating specific existing games. It says nothing about reverse engineering in general.

XDA tested that boundary. When asked whether it could recreate Pokémon Diamond, both Opus 5.5 and the older Opus 5 first refused, but only Opus 5.5 said its session instructions prohibited recreations of specific existing games, in wording close to the leaked text. When XDA instead asked for help with a decompilation project of the same game, Opus 5.5 agreed, offered to translate disassembled functions into readable C and to help rebuild the ROM from the user's own copy. It also outlined how a static recompilation for Windows could work. On that evidence, the instruction is not meant to ban reverse engineering or porting as a whole.

Other reports point the other way. Tom's Hardware says it received screenshots from a staffer's acquaintance who asked Opus 5.5 in Claude Code to reverse engineer a product activation, and that request also triggered safeguards. The outlet also mentions a Reddit user who says their account was suspended and then reinstated over using Opus 5.5 with a reverse engineering tool. XDA adds that on October 30 a developer filed a GitHub issue saying Opus 5.5 had started refusing to help with digital board wargame modules built for paying customers from materials those customers supplied. XDA has not reproduced those refusals, and it also notes reports of Opus 5.5 blocking some reverse engineering of TV operating systems.

There is a plausible explanation that does not require a secret ban. Anthropic already runs a Cyber Verification Program, through which only approved organizations get the full set of its frontier models' cybersecurity capabilities. Cracking a product activation looks a lot like a security bypass, and it would be refused under those existing cyber safeguards regardless of the new game rule. Whatever the cause, for the developer who hits a refusal the effect is the same: work that used to go through now stops, and it is hard to tell which rule stopped it.

Why this matters for developers

For most Claude Code users, the game rule will never come up. Nobody building a payments backend or a data pipeline needs to clone a Nintendo title. The real change is about predictability.

A coding agent is not a chat window you consult once in a while. Teams wire it into their editors, their CI pipelines and their review process. They write long project instructions, tune their workflows around how the model behaves and assume that the same version will act the same way tomorrow. A remotely delivered prompt section breaks that assumption quietly. The app version stays the same. The model name stays the same. Yet the instructions the model follows can be different from one session to the next.

That has practical consequences. A refusal can no longer be reproduced reliably, because a colleague on a different account or flag group may not get it. Bug reports become harder to write. Audits become harder too: a company that needs to document which instructions shaped the code an agent wrote now has a moving part outside its own control.

None of this is unique to Anthropic. Every hosted AI product adjusts system prompts, safety classifiers and model routing on the server, often several times a month. Claude Code just made it visible, because it is a local program with a binary people can inspect and a public issue tracker where they can complain.

djcroman's take: closed coding agents just gave open models their best argument

This section is opinion. Everything above is reported fact.

Here is our thesis: if a vendor can change your coding agent's rules from a server overnight, you do not fully own your workflow, and that is the strongest argument yet for open weight models running in a harness you control.

The game rule itself is defensible. Rebuilding someone else's game and calling it original is a copyright problem, and Anthropic has every right to keep its product out of that business. Our issue is not this rule. It is the precedent of rules arriving silently, being discovered by users digging through binaries, and being explained only after the community noticed.

Open weight models change that equation. If you run a model like GLM, Qwen, DeepSeek or Mistral's open releases in your own agent harness, the system prompt lives in a file in your repository. When it changes, you see it in your own git history. Nobody flips a feature flag on your behalf. You also inherit the responsibility: there is no vendor guardrail between you and an IP lawsuit if you misuse the tool.

The honest counterargument is quality. On most coding benchmarks, the best closed models are still ahead, and for many teams the productivity gap is worth more than full control. Hosting a large open model is real work and real hardware, and most developers will never want to do it. We think that gap is shrinking fast enough that control will become a buying criterion, especially for companies that need to explain to auditors how their code was produced.

So which side is right? If your work is routine and the best model saves you hours a week, a hosted agent with occasional surprises is still the rational choice. If your work touches binaries, security research, legacy code or anything a classifier might misread, or if you simply need reproducible behavior, the case for an open model in your own harness just got a lot stronger.

What you can do now

• If Claude Code refuses work you believe is legitimate, Osmani has asked users to send examples his way, and the GitHub issue tracker is the public place to document it.
• If you want to opt out of server side prompt experiments, set CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 and DISABLE_GROWTHBOOK=1, as Anthropic suggested in GitHub issue 62061, and clear old cached values.
• Keep a copy of your own project instructions and note the Claude Code version and model in bug reports, since remote prompt sections can differ between accounts.
• For security research, check whether your organization qualifies for Anthropic's Cyber Verification Program before assuming a refusal is a bug.
• If reproducibility matters to your team, test at least one open weight model in your own harness now, so switching is an option rather than an emergency.

Sources

• Tom's Hardware: Anthropic confirms new Claude Code limits to prevent game cloning (November 2, 2026)
• XDA Developers: Anthropic seems to be testing a potential crackdown on vibe coded ports of existing games
• GitHub issue 62061 on anthropics/claude-code: server side system prompt injection via tengu_heron_brook
• Silicon Report: Anthropic revises Claude Code prompt to curb game recreations