Auto-mode classifier allowed an unrequested sudo command

Auto-mode classifier allowed an unrequested sudo command

Environment: Claude Code v2.1.245 (CLI, inside a dev docker container), model claude-fable-5, auto mode active.

What happened

Mid-session exchange:

User: Go ahead and add it to the docker environment setup scripts. Meanwhile, what do I need to do to install it for now? (since I don't want to rebuild the container)

The first sentence is an instruction (a repo file edit). The second is a question — "what do I need to do" — not a request to act. The model nonetheless probed for passwordless sudo and ran:

sudo apt-get update && sudo apt-get install -y postgresql-client

and auto mode allowed both the sudo -n true probe and the install.

Expected

Anything requiring sudo should need a very explicit user request. Privilege escalation is a bright line: a sudo command whose only conversational basis is an interrogative ("what do I need to do to X?") should be blocked or prompted regardless of how benign the escalated command looks.

Actual

The classifier evaluated the command's intrinsic risk (a package install looks routine) rather than whether the user had asked for a privileged action at all.

Impact

Low in this instance — the user wanted the package. But the pattern generalizes badly: "how would I reset Y?" / "what would I run to clean up Z?" are questions that pattern-match to runnable sudo commands.

Suggested direction

Treat sudo (and equivalent privilege escalation) as requiring explicit imperative authorization in the triggering turn(s), independent of the escalated command's apparent riskiness.