Auto mode denies approved actions

“In auto mode, the permission classifier blocked actions the user had explicitly and repeatedly approved, gave no usable reason, and offered no way to approve.”

Is this your bug? What gets counted gets fixed. Pile on.

Paste this into your agent. It files your report, with your error and version.

I hit this bug: rapsheet.dev/sheets/claude-code/issues/521/file
Follow it to file my report. Show me the text before you send.

No install. No account. Public and anonymous. The link asks your agent for one report, nothing else. What it sends

Growing. 2 reports and thumbs-up in the last 7 days and none the week before, down from 27 a week at the late-September peak. Not fixed, but a workaround is known.

Auto mode classifier denies actions the user explicitly approved. Denials give no explanation or a generic one, and Remote Control or project thread users have no way to override from the phone.

Is this your bug?

File my report

Where: auto mode classifier
Error text: judged this action dangerous (it gave no explanation)
Versions: 2.1.278 to 2.1.296
Platforms: Linux, macOS, Web, Windows
How bad: Breaks a normal workflow.

Part of: Auto mode blocks approved actions13 bugs

Classifier overrides allow rules9 people
Classifier blocks after leaving auto5 people
Auto mode inconsistent verdicts7 people
Classifier denies in bypass mode5 people
Auto mode refuses approved actions4 people
Computer use approval never shown5 people
Auto mode blocks inconsistently4 people
Auto mode blocks approved commands3 people
Auto mode classifier denies user-authorized security work inconsistently2 people
Routine actions denied by classifier2 people

Show all 12Show only the largest 10

Auto mode denies relayed approvals2 people
Auto Mode blocks actions4 people

Original reports45, newest first

Nov 5, 2026Auto mode blocks actions the owner explicitly ordered on their own machine and files#107836
Oct 22, 2026Auto mode blocks user-approved permission changes with no in-chat override#104441
Oct 22, 2026Auto mode: Claude caused a staging outage, then refused (3 times, 3 different reasons) to run the recovery command the user ordered, and blocked read-only commands#104235
Oct 21, 2026Auto mode: explicitly requested Terraform Cloud apply only happens after the user asks again, repeatedly#103942
Oct 21, 2026Auto-mode classifier hard-refuses explicitly authorised actions, with no route to an approval prompt or an allow rule#103916
Oct 20, 2026Auto mode classifier blocks an explicitly user-requested action (Terraform Cloud apply) with no explanation, even after repeated approval#103895
Oct 20, 2026Remote/project-thread sessions: no way to choose "ask for approval" instead of Auto-mode auto-deny#103687
Oct 15, 2026Remote Control sessions started from a Project ignore defaultMode and always run in auto mode#102341
Oct 11, 2026Auto-mode permission check blocks subagent launch ("Modify Shared Resources") despite explicit, broad user authorization for the exact work#101396
Oct 10, 2026Restrictive permissions / no bypass permissions on Claude Projects#101030

Show all 45Show only the newest 10

Oct 10, 2026Auto mode denies explicitly approved low-stakes config changes over Remote Control and in project threads; no override from the phone#101018
Oct 9, 2026Auto mode classifier blocks the account owner's own scheduled task ("Cowork Run Routine Now"), and blocked file transfer between the owner's own machines#100730
Oct 7, 2026Auto mode: classifier keeps denying actions after explicit user approval, with no approval path for a remote (project thread) user#100374
Oct 7, 2026Auto-mode classifier blocks merging a PR into the user's own repo even when the user's standing workflow requires it ("Merge Without Review")#100370
Oct 7, 2026Auto mode classifier blocks user-approved actions; no override available over Remote Control#100331
Oct 7, 2026Projects beta: Auto-mode denials of relayed approvals turn into persistent "type go" rituals#100219
Oct 7, 2026Claude is blocking be from doing anything these stupid security checks are anno…#100134
Oct 6, 2026Auto mode classifier denies a local file edit on the agent's own branch as [Modify Shared Resources], even after explicit user instruction#99911
Oct 5, 2026Claude Code blocks explicitly authorized hardware monitoring setup on my PC without explaining why#99841
Oct 5, 2026Auto mode classifier blocks explicitly user-requested merges/deploys; typed approvals in headless claude -p (Slack/remote) never count#99813
Oct 3, 2026Content classifier blocking authorized code modifications to open-source projects#99313
Oct 3, 2026Auto mode blocks the agent from repairing a production incident the agent itself caused, even after repeated explicit user instruction#99153
Oct 2, 2026Auto-mode classifier blocks a verification-environment deploy as "Production Deploy" even when the user explicitly orders it, and the block spreads to unrelated read-only actions#99133
Oct 2, 2026Auto-mode classifier permanently blocks git push; chat approval cannot clear it#99058
Oct 1, 2026Permission approval not applied: migration remains denied despite explicit approval#98834
Oct 1, 2026too much security checks, my agents cant run by them self#98717
Oct 1, 2026Desktop app auto mode classifier denies explicitly requested commands (deploy.sh, gh) with no in-session way to approve#98598
Sep 30, 2026Auto mode denies 'Git Destructive' commands with no approval path; the non-auto prompt then recommends switching back to auto mode#98569
Sep 30, 2026Auto mode classifier blocks actions the user explicitly ordered in-session (merge, deploy, reading test credentials, verification reads)#98478
Sep 29, 2026Auto mode classifier blocks production deploy steps that it allowed earlier, and ignores explicit user authorization and CLAUDE.md#98199
Sep 29, 2026Auto mode classifier blocks explicitly authorized git push / git branch -D, with no reason given and no in-chat way to authorize#98079
Sep 29, 2026The safety check, keeps denying simple tasks about relegating tasks to codex or…#98064
Sep 28, 2026Auto-mode classifier blocks user-approved removal of leaked personal data from a template ([Auto-Mode Bypass]), with no way to confirm in-session#97972
Sep 28, 2026Web (cloud) session, Auto mode: classifier denies an explicitly user-requested add_repo(push); UI/mode guidance from the assistant was wrong#97969
Sep 28, 2026New cloud Projects is good, with some limitations#97947
Sep 28, 2026Auto mode classifier denial cannot be overridden by the owner's explicit in-chat consent (no approval prompt)#97942
Sep 28, 2026Auto mode classifier halts explicitly user-authorized work: a local docker build flagged as "Production Deploy"; removing an owner-ruled fake control flagged as "Security Weaken"#97923
Sep 28, 2026Auto mode classifier blocks reading .env.prod inconsistently across sessions, even on explicit user request#97808
Sep 27, 2026Auto mode classifier denies routine user-requested actions since ~2.1.268 with no in-session override; forced us into bypassPermissions#97654
Sep 27, 2026Auto mode blocks user-approved actions too frequently#97631
Sep 27, 2026Auto mode classifier now blocks client work that clients explicitly authorized (regression since ~Sep 23, Opus 5.5)#97613
Sep 25, 2026I don't have enough context to generate an appropriate GitHub issue title. Could you please provide: 1. The specific problem or bug you encountered 2. Error messages (if any) 3. What you were trying to do when the issue occurred 4. Expected#97008
Sep 24, 2026Claude Code Projects (Beta). The auto-mode permission check blocks approved work in cloud environments and Projects#96775
Sep 17, 2026Auto mode regression since 2.1.270: classifier blocks a solo owner's own routine release work (12× more denials), and the Manual fallback costs 55+ permission clicks for a 2-key config change#95200
Sep 15, 2026Merge/push-to-main classifier blocks git push and gh pr merge even with full permissions.allow and Auto Mode configured#94633