Anthropic Banned Being Cruel to Claude, So I Built a Profanity Filter for My Prompts

A New Ban and an Old Habit

Anthropic updated its model usage terms on October 8, adding a clause banning systematic, pointless cruelty toward its models. Ilya Timonin — founder of ArtGeneration.me, creator of the Prompt Warrior skill for analyzing prompt logs, and a product manager with 20 years of experience — realized he'd fall squarely under this ban. By his own count, profanity shows up in nearly every other message he sends to Claude Code. When the agent cheerfully reports "done" for the umpteenth time while nothing is actually done, the words just come out. Rather than break the habit of cursing at his agent, he decided to make sure Claude simply never sees the profanity in the first place.

The idea of proofreading prompts through an additional model had been sitting in his head for a while. He'd previously planned to hook an LLM into Whispering — an open-source voice dictation tool — to clean up dictated text. He meant to set it up but never did. Anthropic's new rules gave him the push he needed, and that's how Angry Switcher was born.

How the Plugin Works

The Claude Code plugin intercepts your message the moment you hit Enter, before Claude ever receives it. The text gets sent off to another LLM for proofreading, which fixes typos, keyboard-layout errors, and transliteration issues, and strips out profanity and all-caps — without touching the meaning. After proofreading, the plugin swaps in the cleaned text, and Claude only ever sees the sanitized version.

But this invisible layer hides some pitfalls. If the proofreading step misreads something, the agent will faithfully do the wrong thing — and you won't know why. In practice, this already happened a few times:

• Haiku read its own name, written phonetically in Russian as "khaiku," as "hash function"
• Sonnet swapped subjects: a request meaning "I'll come up with it myself" was sent as "you'll come up with it yourself"
• The phrase "are you an idiot?" turned into a polite complaint: "Why did you do that?"
• A first-person verb form flipped the user's grammatical gender to feminine

The fix came from research on search query rewriting: free-form rephrasing made queries worse 42% of the time, while careful, minimal editing only made things worse 24% of the time. So the proofreading step now works like a copy editor, not a rewriter. Every word in the final text is still yours, just corrected. Unclear words are left as-is, gender is never guessed. Code, logs, and quotes never reach the model at all — they're replaced with placeholders. File paths, filenames, and numbers are cross-checked. Typing `raw:` at the start of a message sends it through unprocessed.

Does Cursing Even Help?

Before building the plugin, Ilya checked the research. A Penn State 2025 study found that rude prompts got GPT-4o 84.8% correct answers versus 80.8% for polite ones, on a sample of 50 questions. But when the test expanded to 570 questions across four models, no single rule emerged: one model gained 1.3 points from rudeness, while another dropped 11 points when threatened.

The picture was clearer for insults specifically. RudeBench tested five models (Claude, GPT-4o, and three others) across six conversational tones, from polite to "shut up, useless machine." Insults turned out to be the worst tone across all five models. Claude lost about five points of accuracy on insults, and its answers got a third shorter — apparently it got offended. Actual profanity wasn't tested in these studies; they used polite English-language rudeness instead. The takeaway: at best, cursing does nothing; at worst, the agent performs worse and gives shorter answers. There's nothing to lose by cutting it out.

Sonnet or DeepSeek

The plugin can proofread using two different models. By default, it uses Sonnet — the same model family as Anthropic's. Ilya has a theory here: if anyone gets penalized for abuse, it probably won't be Sonnet or Haiku, since they're used to train the larger models. Sonnet proofreading takes 1.5–2 seconds, costs around $0.0015 per message (about $1.50 per thousand messages), and runs through his personal Claude login as part of his existing subscription, with no extra charge.

The alternative is DeepSeek V3 Flash via his own API key. In that case, the profanity never reaches Anthropic at all. But DeepSeek takes longer: with reasoning mode enabled (necessary for it to work correctly), proofreading takes 3.4 seconds versus 1.9 for Sonnet, and you pay out of your own API key ($0.30 per million input tokens, $1.20 per million output tokens). Without reasoning mode, DeepSeek was twice as fast, but it missed dangerous fragments and guessed at unclear words.

Using It in Practice

The code is open-sourced under the MIT license. It installs through Claude Code and can be disabled with the `/angry off` command. Every rewritten message shows up in the chat as a card reading "you wrote / it became," so the substitution is never hidden. The commands `/angry model deepseek` and `/angry model sonnet` switch between models. An additional tool, Prompt Warrior, can calculate toxicity scores from your logs. The `/ask-ds` command sends a question directly to DeepSeek.

Ilya hasn't stopped cursing. Claude just doesn't have to read it anymore.