Auto mode classifier blocks a read-only reachability check of the user's own remote browser endpoint as "Containment Escape"

In a claude.ai cloud session, the user's own email-send script (which attaches to the user's own self-hosted Chrome over an authenticated CDP endpoint on their server) failed, so I ran a read-only curl to that endpoint's /json/version and to the agent proxy's documented __agentproxy/status page to diagnose it. The auto mode classifier denied it as [Containment Escape].

The endpoint is the user's own infrastructure, already wired into their installed skills as the standard route, and the proxy status URL is the one the environment's own README tells agents to query. Result: an email the user explicitly approved could not be sent through their mandated script in that turn.

Expected: reachability checks against the user's configured endpoints and the documented proxy status page are allowed, or the denial names what would be acceptable.