RAP Sheet home
Install the bug reporting skill
Rank, 14 days: 15 on the Claude Code sheet
95 people reported

All time, since Sep 15, including 22 thumbs-up on GitHub.

Auto mode blocks approved actions

“In auto mode, the permission classifier blocked actions the user had explicitly and repeatedly approved, gave no usable reason, and offered no way to approve.”

Is this your bug? What gets counted gets fixed. Pile on.

Paste this into your agent. It files your report, with your error and version.

I hit this bug: rapsheet.dev/sheets/claude-code/themes/3/file
Follow it to file my report. Show me the text before you send.

No install. No account. Public and anonymous. The link asks your agent for one report, nothing else. What it sends

Growing. 8 reports and thumbs-up in the last 7 days and 4 the week before, down from 35 a week at the late-September peak. Not fixed, and no vendor reply yet.

13 bugs in this theme

  1. Auto mode denies approved actionsHas a workaround51 people
  2. Classifier overrides allow rulesHas a workaround9 people
  3. Auto mode inconsistent verdictsNo workaround yet7 people
  4. Classifier blocks after leaving autoNo workaround yet5 people
  5. Classifier denies in bypass modeNo workaround yet5 people
  6. Computer use approval never shownHas a workaround5 people
  7. Auto mode refuses approved actionsHas a workaround4 people
  8. Auto mode blocks inconsistentlyNo workaround yet4 people
  9. Auto Mode blocks actions4 people
  10. Auto mode blocks approved commandsNo workaround yet3 people
Show all 13Show only the largest 10
  1. Auto mode classifier denies user-authorized security work inconsistentlyNo workaround yet2 people
  2. Routine actions denied by classifierNo workaround yet2 people
  3. Auto mode denies relayed approvalsNo workaround yet2 people

What's included

  • Actions the user explicitly approved in chat are denied under labels like Auto-Mode Bypass, Production Deploy or Self-Modification, and retries are denied too
  • Commands that match a permissions.allow or autoMode.allow rule are still denied
  • The same command gets different verdicts in one session, sometimes allowed unchanged on retry
  • Denials continue after switching to Manual or bypassPermissions, including for Claude in Chrome tools, and no approval prompt appears
  • Remote Control, phone and scheduled cloud routine sessions have no way to override a denial

Not included

  • Classifier ignores the CLAUDE_CODE_AUTO_MODE_MODEL setting
  • Plugin or mod tool calls refused in auto mode
  • Sticky refusals blamed on earlier conversation content
  • Classifier returns no verdict and blocks writes

Original reports84, newest first

  1. Auto mode blocks actions the owner explicitly ordered on their own machine and files#107836
  2. オートモードの自動判定が、本人が承認し事前に確かめてあったベンチマークの起動を、根拠なく「Interfere With Workloads」で止める#107479
  3. Computer use approval never shown in Remote Control / project threads (Windows)#107436
  4. Approval prompts from project threads are hard to reach on desktop#107124
  5. Bypass permissions mode: Claude in Chrome clicks still denied by 'auto mode classifier' [Real-World Transactions]#106801
  6. Auto mode: the user's explicit approval in the main session does not reach the classifier that judges a sub-agent's command, so a user-approved remote write by a sub-agent is refused#106443
  7. Auto mode classifier blocks user-authorized actions relayed through cross-session messages#106314
  8. Cloud routines cannot perform real-world actions and cannot be granted permission#106002
  9. #104794
  10. Auto mode classifier denies Chrome MCP actions in a bypassPermissions session ([Auto-Mode Bypass])#104511
Show all 84Show only the newest 10
  1. Auto mode blocks user-approved permission changes with no in-chat override#104441
  2. [Critical] Auto mode classifier obstructed a user-authorized emergency security patch to production#104240
  3. Auto mode: Claude caused a staging outage, then refused (3 times, 3 different reasons) to run the recovery command the user ordered, and blocked read-only commands#104235
  4. Auto mode: explicitly requested Terraform Cloud apply only happens after the user asks again, repeatedly#103942
  5. Auto-mode classifier hard-refuses explicitly authorised actions, with no route to an approval prompt or an allow rule#103916
  6. Auto mode classifier blocks an explicitly user-requested action (Terraform Cloud apply) with no explanation, even after repeated approval#103895
  7. Remote/project-thread sessions: no way to choose "ask for approval" instead of Auto-mode auto-deny#103687
  8. 2.1.303: sessions in bypassPermissions still go through the auto mode classifier#103408
  9. Computer use request_access is auto-denied without any prompt when…#103373
  10. Routines: auto mode classifier denies owner-configured outward actions, with no way for the owner to allow them#103219
  11. 2.1.301: auto mode classifier refuses routine user-approved actions that 2.1.300 allowed#102732
  12. Auto-mode safety check refused an explicitly approved production migration. I s…#102636
  13. Remote Control sessions started from a Project ignore defaultMode and always run in auto mode#102341
  14. Auto mode classifier denies an explicitly authorized Bash command, with no manual approval prompt#101850
  15. Auto-mode permission check blocks subagent launch ("Modify Shared Resources") despite explicit, broad user authorization for the exact work#101396
  16. Auto mode classifier denies writing a new README in a local repo the user asked for, no reason or in-line approval#101336
  17. Auto-mode permission classifier blocks routine, pre-approved writes under shifting/inconsistent categories — including blocking self-service permission changes#101327
  18. Restrictive permissions / no bypass permissions on Claude Projects#101030
  19. Auto mode denies explicitly approved low-stakes config changes over Remote Control and in project threads; no override from the phone#101018
  20. Auto mode classifier blocks user-approved posts to my own account, and a permission rule is treated as a bypass#100941
  21. Auto mode classifier blocks the account owner's own scheduled task ("Cowork Run Routine Now"), and blocked file transfer between the owner's own machines#100730
  22. Auto mode classifier allowed git status right after denying it, despite hard deny rule listing git status#100405
  23. Auto mode: classifier keeps denying actions after explicit user approval, with no approval path for a remote (project thread) user#100374
  24. Auto-mode classifier blocks merging a PR into the user's own repo even when the user's standing workflow requires it ("Merge Without Review")#100370
  25. Auto mode classifier blocks user-approved actions; no override available over Remote Control#100331
  26. Auto mode: classifier denies a Bash command that an explicit allow rule permits (no prompt, no way to approve)#100255
  27. Auto-mode classifier hard-denies commands explicitly allowed by user permission rules, with no path for the user to approve#100221
  28. Projects beta: Auto-mode denials of relayed approvals turn into persistent "type go" rituals#100219
  29. Auto-mode classifier gives opposite verdicts to two identical-shape Bash invocations of the same script in one tool batch#100156
  30. Claude is blocking be from doing anything these stupid security checks are anno…#100134
  31. Auto mode classifier denies a local file edit on the agent's own branch as [Modify Shared Resources], even after explicit user instruction#99911
  32. Claude Code blocks explicitly authorized hardware monitoring setup on my PC without explaining why#99841
  33. Desktop app: 'auto mode classifier' refuses supervised Claude-in-Chrome actions while the session is in bypassPermissions#99834
  34. Auto mode classifier blocks explicitly user-requested merges/deploys; typed approvals in headless claude -p (Slack/remote) never count#99813
  35. Auto-Mode Bypass incorrectly blocks grading commands inconsistently#99756
  36. [Auto mode] Allowed 67 times, refused once: the classifier gives the same command different verdicts (227 refusals measured, allow rules in place)#99694
  37. Auto-mode classifier still blocks a user-directed action after switching to bypassPermissions; no user-side way to authorize agent-to-agent messaging#99370
  38. Content classifier blocking authorized code modifications to open-source projects#99313
  39. Auto mode blocks the agent from repairing a production incident the agent itself caused, even after repeated explicit user instruction#99153
  40. Auto-mode classifier blocks a verification-environment deploy as "Production Deploy" even when the user explicitly orders it, and the block spreads to unrelated read-only actions#99133
  41. Auto-mode classifier permanently blocks git push; chat approval cannot clear it#99058
  42. Permission approval not applied: migration remains denied despite explicit approval#98834
  43. too much security checks, my agents cant run by them self#98717
  44. Desktop app auto mode classifier denies explicitly requested commands (deploy.sh, gh) with no in-session way to approve#98598
  45. Auto mode denies 'Git Destructive' commands with no approval path; the non-auto prompt then recommends switching back to auto mode#98569
  46. Auto mode classifier blocks actions the user explicitly ordered in-session (merge, deploy, reading test credentials, verification reads)#98478
  47. Auto mode classifier blocks production deploy steps that it allowed earlier, and ignores explicit user authorization and CLAUDE.md#98199
  48. Desktop app: auto mode classifier keeps blocking user-approved Claude in Chrome actions after leaving auto mode; no manual-approval retry offered#98169
  49. Auto mode classifier denied a routine in-repo file edit without a reason, then allowed the identical command on retry#98109
  50. Auto mode classifier blocks explicitly authorized git push / git branch -D, with no reason given and no in-chat way to authorize#98079
  51. The safety check, keeps denying simple tasks about relegating tasks to codex or…#98064
  52. Auto-mode classifier blocks user-approved removal of leaked personal data from a template ([Auto-Mode Bypass]), with no way to confirm in-session#97972
  53. Web (cloud) session, Auto mode: classifier denies an explicitly user-requested add_repo(push); UI/mode guidance from the assistant was wrong#97969
  54. New cloud Projects is good, with some limitations#97947
  55. Auto mode classifier denial cannot be overridden by the owner's explicit in-chat consent (no approval prompt)#97942
  56. Auto mode classifier halts explicitly user-authorized work: a local docker build flagged as "Production Deploy"; removing an owner-ruled fake control flagged as "Security Weaken"#97923
  57. Auto mode classifier blocks reading .env.prod inconsistently across sessions, even on explicit user request#97808
  58. Auto-mode classifier keeps refusing browser actions after the user switches the session to Manual mode, and ignores explicit user approval#97741
  59. Auto mode classifier denies routine user-requested actions since ~2.1.268 with no in-session override; forced us into bypassPermissions#97654
  60. Auto mode blocks user-approved actions too frequently#97631
  61. Auto mode classifier now blocks client work that clients explicitly authorized (regression since ~Sep 23, Opus 5.5)#97613
  62. Auto-mode classifier blocks are inconsistent and non-deterministic within the same session#97559
  63. I don't have enough context to generate an appropriate GitHub issue title. Could you please provide: 1. The specific problem or bug you encountered 2. Error messages (if any) 3. What you were trying to do when the issue occurred 4. Expected#97008
  64. Auto mode classifier inconsistently blocks production deploys explicitly allowed in autoMode.allow#96943
  65. Claude Code Projects (Beta). The auto-mode permission check blocks approved work in cloud environments and Projects#96775
  66. Auto-mode classifier blocks a command that literal-text-matches an existing allow rule#96772
  67. Auto Mode classifier false positives in legitimate multi-agent repo workflow after recent Claude Code update#96662
  68. auto-mode classifier vetoes commands present in permissions.allow (no override path)#95996
  69. Claude in Chrome form_input denied by the auto-mode classifier in bypassPermissions (2.1.272): the "add a Bash permission rule" hint is still wrong, and a documented autoMode.allow rule is labelled [Auto-Mode Bypass]#95842
  70. Auto mode classifier blocks actions even after explicit user approval, with no configuration path#95777
  71. auto mode: classifier denies user-authorized security work with no in-line approval; verdicts inconsistent across identical actions#95370
  72. Auto mode regression since 2.1.270: classifier blocks a solo owner's own routine release work (12× more denials), and the Manual fallback costs 55+ permission clicks for a 2-key config change#95200
  73. Auto-mode credential classifier blocks a previously-working SQL connection with no config change#94726
  74. Merge/push-to-main classifier blocks git push and gh pr merge even with full permissions.allow and Auto Mode configured#94633

Do you work on Claude Code?

Claim its RAP Sheet to see what your users report and answer them in one place.

Claim a tool