Auto mode classifier blocks skill allowed-tools commands and edits to the user's own skills, even with explicit approval

Update: more inconsistent verdicts, then a persistent session-wide block

1. A disconnect skill with allowed-tools: Bash(lsof -ti :5433), Bash(lsof -i :5433), Bash(kill *) ran kill $(lsof -ti :5433) without a block. A few minutes later, the identical skill for port 5435 (kill $(lsof -ti :5435), same rule shape) was "Blocked by fast classifier". If Bash(kill *) is dropped as too broad in auto mode, that should be consistent and documented.

1. Two things from earlier that I should have included:

• A skill's allowed-tools grant lasts only for the turn that invokes it. If the skill asks the user a question (for example for SSH credentials), every later step runs in a new turn and gets blocked. Skill authors aren't warned about this interaction with auto mode, and nothing in the denial message points to it.
• Skill scripts that the user created in their own terminal ran fine under the script-path rules. But the model was blocked from creating those same scripts, even when the user explicitly asked it to.

1. Next, a plain edit to the step text in the user's own ~/.claude/skills/*/SKILL.md failed with:

> Auto mode could not evaluate this action and is blocking it for safety — a safety check separate from auto mode blocked this request because of earlier conversation content — it isn't about the action itself ... it will keep firing for the rest of this conversation.

Near-identical step-text edits had succeeded earlier in the same session. From that point, the session couldn't edit any file, and the only workaround offered was leaving auto mode or starting a new session. The "earlier conversation content" was itself a long run of false-positive classifier blocks on routine skill maintenance. The blocks seem to build on each other until the session is unusable.

just generically "using claude" in the last week, been getting denied on all kinds of things, from "open a PR" to "make a jira ticket in a sprint", to all kinds of commands on the terminal and thru MCPs, even read-only ones

I can't find any info on this "fast classifier", but it seems very new, and very not helpful

(note this is not just skill usage in my case, just generic claude code agentic sessions)

Seeing the same thing in Claude Tag (Claude in Slack), 2026-10-01, sessions in auto mode, model claude-sonnet-5-5.

• Denial: "Permission for this action was denied by the Claude Code auto mode classifier. Reason: Blocked by fast classifier." No category named.
• Identical calls flip between allowed and blocked minutes apart, with no config change: Slack Web API slackLists.items.create passed at 19:09 and 19:12, blocked at 19:07 and 19:15 PT; Google Calendar MCP create_event and Google Docs update_doc show the same pattern. Baseline across 9 sequential single-write requests: 4 allowed, 5 blocked.
• Reads are affected too (slackLists.items.list and conversations.history blocked, then allowed on a fresh request).
• Org-level Auto mode allow rules that name the exact methods (e.g. slackLists.items.create) do not prevent the block, and an explicit user confirmation in the thread does not reliably clear it.
• Blocks occur both at worker (subagent) dispatch and at the tool call inside the worker.

Happy to share session details through support.