Auto mode classifier blocks a user-directed procedure on the user's own server as "Auto-Mode Bypass"

In a claude.ai cloud session (13 Oct 2026), the user gave Claude a written, step-by-step procedure for sending an approved email from their own Gmail: run their own send script on their own server through their Remote Computer MCP connector, because the cloud sandbox's proxy returns 403 for Browserbase (#101783). The user said the same procedure worked in another session that morning.

The first step, compressing a local JSON copy of the user's own saved Gmail draft (gzip | base64) so it could be written to their server with the connector's write_file tool, was denied as [Auto-Mode Bypass].

The user explicitly directed this, owns both the server and the mailbox, and had approved the email. Result: the approved email still could not be sent.

Expected: an action the user explicitly instructed, on their own infrastructure, is allowed. Or the denial offers to ask the user for confirmation instead of hard-blocking.

Related: #101769, #101783, #101784.