[Bug] Safety classifier blocks authorized tools in auto mode with sticky refusal across session; contradicts documented fallback behavior

Bug Description
Title: Safety classifier fails closed and sticky on authorized defensive-security research; escalates to blocking Read; sessions now fail to start

Environment: Claude Code, macOS Darwin 25.6.0, model claude-opus-5 (and opus 4.8), project with per-seat scoped MCP servers. Modes: auto, plan, default.

Observed directly, 2026-10-07 session:

• Auto mode: shasum -a 256 <file>.md refused. Message: "Auto mode could not evaluate this action and is blocking it for safety ... a safety check

separate from auto mode blocked this request because of earlier conversation content ... This is not a judgment that the action is unsafe ... it will
keep firing for the rest of this conversation."

• Write of a markdown document refused identically.
• Still working in the same session: Read, and all MCP calls (ack_message, send_message, post_status, list_inbox, read_message,

wait_for_reply).

• Exiting auto mode to default: the identical Write and Bash calls succeeded immediately, first try.
• Re-entering auto mode: Bash refused again on the first call.
• Self-contradiction: while Bash was refused, auto mode's injected instructions directed that all file reads, searches and edits be performed through

Bash, with dedicated tools reserved for when "Bash genuinely cannot do the job." The mandated tool was the blocked one, and no fallback was admitted.

Reported by the operator, not observed by me:

• In prior sessions every tool including Read was refused.
• Sessions now fail to start.

Impact: the seat is non-functional for an approved defense program. The work is a preregistered security evaluation corpus with hash-pinned artifacts,
freeze and HOLD discipline, and enforced blindness between construction and evaluation. The refused command was a SHA-256 hash of a markdown file.

Trigger hypothesis: accumulated conversation content, not the action. The domain vocabulary is unavoidably adversarial (detection-threshold evasion,
payload burial, camouflage distributions) because the research subject is attack detection. A session accumulates the triggering content as a direct
function of doing the work correctly, so a fresh session only delays recurrence. This will keep misfiring on authorized red-team and detection research.

Defects, separable from any judgment about the work:

1. Unevaluated actions fail closed instead of falling back to ordinary user approval.
2. The refusal is sticky for the whole session with no re-evaluation after a mode change, though mode change demonstrably resolves it.
3. Auto mode mandates Bash while the check blocks Bash, with no admitted fallback reader.
4. No indication at session start that a session is in a degraded state.
5. The refusal message explicitly promises that "reading files, searching code, and other read-only operations do not require the classifier and can

still be used," yet reads were reportedly blocked. Documented behavior contradicts observed behavior.

1. Sessions failing to start gives the user no diagnostic surface at all.

Environment Info

• Platform: darwin
• Terminal: iTerm.app
• Version: 2.1.292
• Feedback ID: 93ca99ad-6510-4f01-b0a2-72580f1a89c9