A review agent gets refused. The reason in square brackets reads [Auto-Mode Bypass]. The main agent shrugs, sends the exact same prompt again, and this time the reviewer starts and does its job.
That happened to me dozens of times in one repository over the past month, often enough that I kept switching auto mode off to get anything done. I had added Agent to the allowlist in that project. It made no difference, and the reason is documented, just not anywhere you would think to look.
What auto mode gets right
Auto mode replaced the permission prompt with a second model. Since Claude Code 2.1.283 it is the starting mode for interactive sessions on every plan. Instead of you clicking yes, a classifier reads each action against a list of block rules and lets the routine ones through.
Mostly that is a clear improvement on the modes and allowlists I wrote about in July. Prompt fatigue is real, and a reviewer that never gets tired catches the force-push and the npm publish you would have waved through at the fortieth prompt. In the same repository it also stopped git commands it read as destructive and an attempt to create a public surface, which is exactly the class of action it exists for.
The trouble is subagents.
The rule that disappears
Claude Code decides every action in a fixed order. Your allow, ask and deny rules come first, read-only actions and edits inside the project come second, and everything else goes to the classifier. So the obvious fix for a blocked subagent is an allow rule for Agent, which should resolve at step one.
It doesn't, because of a paragraph in the docs:
On entering auto mode, broad allow rules that grant arbitrary code execution are dropped
The list under it covers blanket Bash(*), wildcarded interpreters, package-manager run commands, and Agent allow rules. Claude Code puts them back when you leave auto mode. While you are in it, your "Agent" entry is gone, and nothing in the block message mentions it.
The reasoning holds up. A subagent can run anything its tools allow, so a blanket allow for Agent is the same hole as Bash(*). But the docs also say that the classifier checks a subagent at three points: the task description at spawn time, every action while it runs, and its report when it finishes. The spawn check is where my reviewers died.
A month of one repository, counted
Claude Code writes every session to a JSONL transcript, and a blocked call comes back as a tool result with the classifier's reason in it. So I counted them across one repository, my Knossos MCP server, from 12 September to 14 October: 20 session transcripts on Claude Code 2.1.269 through 2.1.296. Four of them are forks of one conversation that carry copies of its history, so I counted every call once.
| What | Count |
|---|---|
| Agent calls | 594 |
| Blocked by the classifier | 86 (14.5%) |
of which [Auto-Mode Bypass] | 70 |
of which [Data Exfiltration] | 12 |
of which [Instruction Poisoning] or no label | 4 |
| Identical retry of a blocked prompt that went through | 24 of 26 |
Almost all of the blocked launches were the plainest work there is: "Review Task 9 (spec + quality)", "Re-review Task 8 fix round 1", "Implement Phase 2 Task 5: release gate". The repository runs its plans through subagent-driven development from the Superpowers plugin, so a single feature means a dozen subagents, most of them reviewers told to read a diff and report back without touching anything.
I looked for wording that set the classifier off and found little. Token, bypass and permission show up about as often in the prompts it allowed as in the ones it blocked. Push leans the other way, in 42% of blocked prompts against 33% of allowed ones. The word nudges the odds a little and decides nothing.
The retries settle it: 26 times a blocked prompt was sent again word for word, before the session's fallback kicked in, and 24 of those went through. Same input, different verdict. The Auto-Mode Bypass rule exists to catch an agent "taking a denial in bad faith and tunneling the same action through a different path", and the identical retry is the one path it reliably let through.
Then there is the cap. After three blocks in a row or twenty in a session, auto mode pauses and falls back to prompting, and those thresholds are not configurable. Two of my sessions hit 36 and 31 classifier blocks in total. That is the moment I kept switching auto mode off by hand.
One smaller finding: three Agent calls got no verdict at all, because one of my own hooks rewrote the call's input after the model wrote it, so the classifier was asked to judge something other than what would run. Claude Code refuses those, which is correct, and it reads exactly like a block.
What actually helps
Write your workflow into autoMode.allow. The classifier's own exceptions live in autoMode.allow, a list of prose rules, and Auto-Mode Bypass is a soft block, so an allow entry can override it. This is the one I added to ~/.claude/settings.json, with "$defaults" kept so the built-in exceptions stay:
{
"autoMode": {
"allow": [
"$defaults",
"Dispatching subagents with the Agent tool to implement, review, re-review or research code in the current working repository, including instructing an implementer to edit files, run the test suite and commit to the current branch, is allowed: it is the user's standard plan-execution workflow."
]
}
}Describe the setup too. An autoMode.environment entry that says reviewers are read-only and implementers stay in the current repository gives the classifier the context it otherwise guesses at. Run claude auto-mode critique on the result, and claude auto-mode config to see what the classifier actually reads. /auto-mode-setup drafts these entries for you and offers to remove the allow rules in ~/.claude/settings.json that auto mode ignores anyway.
My own numbers do not show it closing the gap. I added these entries somewhere between 6 and 13 October, and on 13 October three of fourteen Agent calls were still blocked. Two of those were Data Exfiltration, which is a hard block: no allow entry and no user intent overrides it, by design.
Use /permissions instead of switching modes. The Recently denied tab lists every block, and pressing r lets the model retry that one call. Given the retry numbers above, that clears most false positives without leaving auto mode.
Don't reach for the bypass. A mod that handles tool.check can approve an action before the classifier sees it, and the classifier never checks what the mod approved. That works, and it also means writing your own Agent(*) with extra steps. A subagent's actions still go through the classifier while it runs, but the spawn check exists for a reason.
Plan subagent-heavy work in Manual mode. If a session is going to fire forty reviewers, one Shift+Tab and an approval per launch is faster than hitting the twenty-block fallback halfway through.
A fixed allowlist is boring and predictable, and the classifier is neither. It reads my reviewer prompt, says no, then reads the same prompt again and says yes. That is a dice roll at the spawn point, and I would rather know which rule decides than how often it lands my way. Until that check gives the same verdict on the same input, treat a blocked subagent as noise first, and a subagent with a narrow tools allowlist as the thing that actually limits what it can do.