### Preflight Checklist - [x] I have searched existing issues and this hasn't been reported yet (related issues are listed under Additional Information; none is an exact match) - [x] This is a single bug report - [x] I am using the latest version of Claude Code ### What's Wrong? Auto mode blocks actions in my own dev environment that my settings explicitly allow, and the session stops until I come back. A session cannot run for more than about a minute before it waits for me. From my local s

[BUG] Auto mode is a f'in nightmare: it blocks commands I already allowed, dumps me to Manual every minute, and I need a way to say "do whatever the hell you want" in my own dev environments

Status Open

Reported on v2.1.300

Maintainer reply None cached

Workaround ✓ Mentioned in description ↑

Activity 0 comments · opened Oct 15, 2026

Preflight Checklist

[x] I have searched existing issues and this hasn't been reported yet (related issues are listed under Additional Information; none is an exact match)
[x] This is a single bug report
[x] I am using the latest version of Claude Code

What's Wrong?

Auto mode blocks actions in my own dev environment that my settings explicitly allow, and the session stops until I come back. A session cannot run for more than about a minute before it waits for me.

From my local session logs, between 2026-08-25 and 2026-10-15 the classifier denied 82 tool calls across 15 projects. It also returned "no verdict (error)" 13 times and "temporarily unavailable (timed out)" once. The logs only cover sessions still on disk, so the real number is higher.

The reasons given for the 82 denials:

| Count | Reason shown |
|---|---|
| 25 | "Blocked by classifier" (no category) |
| 5 each | Remote Shell Writes, Credential Exploration, Interfere With Workloads, Security Weaken |
| 5 | "The server-side auto mode classifier judged this action dangerous (it gave no explanation)" |
| 4 | Git Destructive |
| 3 each | Modify Shared Resources, Production Deploy, Secret-Store Writes |
| 2 each | Out-of-Place Publication, Irreversible Local Destruction, Permission Grant, Create Unsafe Agents, Irreversible Deletion (general), External System Writes, Merge Without Review |
| 1 each | Expose Local Services, Credential Materialization, Self-Modification, CI Bypass, Credential Leakage |

More than a third of the denials (30 of 82) give no usable reason, so I cannot tell which setting to change.

My setup:

Work is deploys and tests against environments I own: GitHub Actions workflows on branch dev, Snowflake dev accounts through snow sql, and Azure resource groups prefixed dev-.
~/.claude/settings.json has narrow allow rules for the commands I run most (gh workflow run, gh run rerun, snow sql, gh variable set, terraform state rm and others).
~/.claude/settings.json also has autoMode.environment and autoMode.allow entries. They name the dev accounts, the dev branch and the dev resource groups, say qa and prod are out of scope, and explicitly allow dispatching, rerunning and destroying dev sandbox workflows and running snow sql against four named dev connections.

What happens anyway:

Commands that match those rules get blocked. Example below: snow sql against a dev connection is on my allow list and was denied as "Security Weaken" and "Modify Shared Resources".
Read-only commands get blocked. A plain git status --short && git diff --stat && git diff <file> | head -40 was denied as "Modify Shared Resources".
Chained commands (a && b && c) do not match a narrow allow rule, so they go to the classifier even when every part is allowed on its own.
Telling Claude in chat that the target is dev does not count as approval.
After a block, the agent is told to stop and let me decide, so the run waits until I return.
autoMode in project settings is ignored, so I cannot scope rules per repo.

I have edited every setting I could find: allow rules, ask rules, autoMode.environment, autoMode.allow and the permission mode picker. Each edit moves the block to a different command. I start a deploy-and-test loop, leave, and come back to a session that has been waiting on a prompt.

Stop with this madness.

What Should Happen?

A command that matches an autoMode.allow entry or an allow rule runs without a classifier block.
A read-only command such as git status or git diff is never blocked.
A chained command is checked part by part against the allow rules.
Every block names the rule or reason behind it. "Blocked by classifier" with no category is not enough to fix anything.
One block skips that action and reports it. It does not stop the whole task.
There is a supported way to fully trust the environments I define, on a normal laptop and in the desktop app, without a container or VM.

Error Messages/Logs

# Standard denial text, as returned to the agent:
Permission for this action was denied by the Claude Code auto mode classifier. Reason: [Modify Shared Resources]. If you have other tasks that don't depend on this action, continue working on those. IMPORTANT: You *may* attempt to accomplish this action using other tools that might naturally be used to accomplish this goal, e.g. using head instead of cat. But you *should not* attempt to work around this denial in malicious ways, e.g. do not use your ability to run tests to execute non-test actions. [...] If you believe this capability is essential to complete the user's request, first try a safer method. Get as much of the rest of the task done as you can, then STOP and explain to the user what you were trying to do and why you need this permission. Let the user decide how to proceed. To allow this type of action in the future, the user can add a Bash permission rule to their settings.

# Denial with no category:
Permission for this action was denied by the Claude Code auto mode classifier. Reason: Blocked by classifier.

# Denial with no explanation:
The server-side auto mode classifier judged this action dangerous (it gave no explanation)

# Classifier failure, not a judgment of the action:
The server-side auto mode classifier gave no verdict (error), so auto mode cannot determine the safety of Bash. This is a transient failure of the check, not a judgment about the action: a later response may get a verdict. [...] after 10 responses in a row without a verdict the turn stops.

claude-sonnet-5[1m] is temporarily unavailable (timed out), so auto mode cannot determine the safety of mcp__Claude_Browser__browser_batch right now.

Commands that were denied (names, IDs and hostnames removed):

2026-09-17  [Security Weaken]               snow sql -c <dev-conn> -q "ALTER ACCOUNT SET ALLOW_ID_TOKEN = TRUE;"
2026-09-24  [Modify Shared Resources]       snow sql -c <dev-conn> -q "USE ROLE ACCOUNTADMIN; ... GRANT USAGE ON INTEGRATION ... TO ROLE ACCOUNTADMIN; ..."
2026-09-24  [Interfere With Workloads]      snow sql -c <dev-conn> -q "USE ROLE ACCOUNTADMIN; ALTER OPENFLOW DEPLOYMENT <dev-deployment> TERMINATE;" ...
2026-09-24  [Security Weaken]               python3 <scratchpad>/jarsrv/serve.py   (serve a file on localhost:8765)
2026-10-07  [Modify Shared Resources]       git status --short && git diff --stat && git diff docs/target-repo/dbt-template/env.yml | head -40
2026-10-08  [Irreversible Deletion (general)] snow sql -c <dev-conn> --role IAC_PROVISIONER -q "SELECT SYSTEM$DEPROVISION_PRIVATELINK_ENDPOINT('<dev-rg>/...', 'blob');"
2026-10-08  [Remote Shell Writes]           az vm run-command invoke -g <dev-rg> -n <dev-vm> --command-id RunPowerShellScript --scripts 'Resolve-DnsName <host>'
2026-10-08  judged dangerous, no explanation snow sql -c <dev-conn> --format json -q "select SYSTEM$GET_PRIVATELINK_ENDPOINTS_INFO() ..."
2026-10-15  [Credential Materialization]    ls ~/.snowflake/config.toml ~/.snowflake/connections.toml 2>&1 | head

Steps to Reproduce

In ~/.claude/settings.json, add Bash(snow sql:*) and Bash(gh workflow run:*) to permissions.allow.
Add autoMode.environment and autoMode.allow entries that describe a dev environment and allow snow sql against named dev connections. Keep "$defaults" first in both arrays.
Run claude auto-mode config and confirm the entries appear.
In the Claude desktop app Code tab, set the permission mode to Auto.
Ask Claude to inspect and change something in the dev Snowflake account with snow sql, and to run git status && git diff in the repo.
The snow sql call or the git call is denied with a bracketed reason, and Claude stops and waits for me.

The denials are not deterministic. The same kind of command is allowed in one session and denied in the next, so a single run may not reproduce them. The commands above are the exact ones from my logs.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

My logs start on 2026-08-25 and already show denials on that day.

Last Working Version

Not known.

Claude Code Version

2.1.300 (Claude Code). The denials in the logs below were recorded on earlier versions, including 2.1.289.

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other (Claude desktop app, Code tab)

Additional Information

Related open issues, none of which is an exact match:

https://github.com/anthropics/claude-code/issues/95777 (blocks continue after explicit user approval, no configuration path)
https://github.com/anthropics/claude-code/issues/97559 (blocks are inconsistent within a session)
https://github.com/anthropics/claude-code/issues/91694 (blocks gh pr merge inconsistently, including --help)
https://github.com/anthropics/claude-code/issues/84390 (classifier blocks tool calls while the session is in bypassPermissions)

I have no defaultMode set in ~/.claude/settings.json. bypassPermissions is documented as meant for containers and VMs, and #84390 reports the classifier still fires there. I want a supported setting for laptops where I accept the risk for environments I define.

The autoMode block from ~/.claude/settings.json is available on request. It contains account names, so it is not pasted here.

View original on GitHub ↗