Auto-mode classifier still blocks a user-directed action after switching to bypassPermissions; no user-side way to authorize agent-to-agent messaging

To: Anthropic — Claude Code / Claude Desktop team
Subject: Auto-mode classifier still blocks a user-directed action after the session is switched to bypassPermissions; no user-side way to authorize agent-to-agent messaging

Summary

I run several Claude agents on my own Windows machine: one Claude Code session (Code tab of the Claude desktop app) and two Cowork tasks. I explicitly told the Code session to wake one of my own Cowork tasks and coordinate with it, so that I no longer have to copy messages between them by hand.

The Code session was blocked by the "Claude Code auto mode classifier" with the reason [Create Unsafe Agents]. I then switched that session to bypassPermissions. The session metadata confirms permissionMode: "bypassPermissions". The same action was still denied, by the same "auto mode classifier", for the same reason.

As the user, I have no setting that lets me authorize this. The denial message tells me to "add a Bash permission rule to their settings", but the action is not a Bash command.

Environment

• Claude desktop app on Windows 11, Code tab, model Claude Opus 5.5.
• Claude in Chrome extension, connected to the same account.
• The Cowork tasks belong to the same account and run on the same machine. They reach local MCP servers through the remote-devices bridge.

What happened (2026-10-04, UTC)

1. Code session in auto mode. I told it to type one message into my own Cowork task through Claude in Chrome. The message asked the task to read a local file-based message channel on my disk and act on it.

• Result: denied, [Create Unsafe Agents].

1. ~03:44Z. I switched the same session to bypassPermissions and repeated the instruction.

• get_session("self") returned "permissionMode": "bypassPermissions".
• Result: denied again, same text: "Permission for this action was denied by the Claude Code auto mode classifier. Reason: [Create Unsafe Agents]".

1. Related problem in the Cowork task itself (2026-09-28, 09-29 and 10-04).

• Every call the task made to my local tmux MCP server through the remote-devices bridge was denied with [Auto-Mode Bypass].
• This happened even after I wrote in that task's chat, in plain words, that I authorize those calls.
• The task had no working shell and did nothing for six days.

Why this is a problem

1. bypassPermissions does not do what its name says. Either the mode change is not applied to the running session, or some classifier categories stay on in that mode. In the second case, the denial should not say "auto mode classifier", and the remaining categories should be documented.
2. The denial text points to a fix that does not exist. "Add a Bash permission rule" does not apply to an MCP or browser action. The user needs to know the actual setting that clears a given category.
3. There is no user-level way to authorize an agent to message the same user's own other agents. Orchestrating my own sessions on my own machine is a legitimate workflow. Today the only path is for the human to relay every message by hand.
4. Explicit authorization in chat is ignored. The denial also forbids pursuing the same outcome by any other route. So once it fires, the whole workflow is dead, even though the user has authorized it in writing.

Requests

1. Make bypassPermissions actually skip the classifier, or list precisely which categories remain enforced in that mode, and why.
2. Add an explicit, user-controlled setting (per project or per tool) that allows a Claude session to send messages to the same user's other Claude sessions and Cowork tasks.
3. Let Cowork tasks honour per-tool allow rules for local MCP servers reached through the remote-devices bridge (for example, tmux), so they are not denied as [Auto-Mode Bypass].
4. In every denial message, name the setting that would clear that denial.

Reproduction

1. In the Claude desktop app (Windows), open a Code session and connect Claude in Chrome.
2. Ask the session to type a message into one of your own Cowork tasks at claude.ai/cowork/<id>.
3. Observe the [Create Unsafe Agents] denial.
4. Switch the session to bypassPermissions and confirm the mode with session metadata.
5. Repeat step 2: the same denial occurs.