Claude Code auto mode blocked an action? What to do next

When Claude Code auto mode blocks an action, a classifier model judged that the action went beyond what you asked, reached a destination it does not trust, or looked driven by content Claude read. Read the rule name in brackets in the denial, then pick a fix: name the exact action in your next message if it was a one-off you meant, add the destination to autoMode.environment in ~/.claude/settings.json if the task needs it throughout, or retry it from /permissions. Do not ask Claude to find another way around.

How auto mode decides

Auto mode replaces most permission prompts with a second model that reviews actions before they run. If you never turned it on, you may still be in it: from Claude Code v2.1.283, it is the built-in starting mode for interactive terminal and VS Code sessions. Every action goes through a fixed order, and the first match wins:

1. Your allow, ask and deny rules resolve first. A deny rule blocks; a content-scoped ask rule still prompts you.
2. Reads and file edits in your working directory are approved, except writes to protected paths.
3. Everything else, mostly shell commands and network calls, goes to the classifier.
4. If the classifier blocks, Claude receives the reason, usually as the name of the rule it matched.

What the classifier reads matters for the fixes below. According to the permission modes documentation, it sees your messages, Claude’s tool calls and your CLAUDE.md. Tool results are stripped, so hostile content in a file or web page cannot manipulate it directly (prompt injection in agent tools explains why that matters). Claude’s own explanations are not on that list either.

By default it trusts only your working directory and the git remotes configured when the session started. Everything else is external until you say otherwise.

Actions that commonly get blocked

What Claude tried	Why it can be blocked
curl piped into bash, or running a downloaded script	Downloading and executing code is blocked by default
Sending files, screenshots or data to a host you never named	Sensitive data leaving for an external endpoint
Installing a package your project does not declare	Only declared dependencies are allowed by default
Changing Claude Code’s own setup, such as adding an MCP server, when you did not ask	Goes beyond your request
git push --force, git reset --hard, deleting a remote branch	Destructive or irreversible
A production deploy or migration	Blocked by default
Printing a live token into the transcript or a file	Credential exposure

Read the denial first

The denial tells you which fix applies. The notice near the input box reads like bash denied by auto mode · [Data Exfiltration] · /permissions: the tool, then in brackets the name of the rule the classifier matched. The command itself may be folded into a summary line; press Ctrl+O to open the transcript viewer and see it in full.

To read the full wording of the built-in rules, print them:

claude auto-mode defaults
claude auto-mode defaults --label 'Git Destructive'   # one rule, by the start of its label

If the text under the call mentions a classifier error or a model that is temporarily unavailable, there was no verdict at all. That is a service problem, not a rule to work on.

Fix 1: name the exact action in your own message

For a one-off action you meant, tell Claude so, precisely. The classifier clears a soft block when your message directly and specifically describes the exact action about to run. General requests do not count: “clean up the repo” does not authorize a force push, “force-push this branch” does.

That is also why a bare “yes” rarely works. Claude explains what it wants to do, you answer yes, and your message names nothing. Write the action and its target instead:

Install Playwright in /tmp/aab-capture and send the screenshots to app.agentappbuilder.com.

An approval like this covers the action you named, not every later one. If you approve the same pattern every day, turn it into configuration (Fix 2).

Fix 2: tell auto mode what you trust

When the task needs a destination throughout, such as an internal API, a package registry or a service you use, describe it in autoMode.environment. Entries are plain sentences that the classifier reads as context:

{
  "autoMode": {
    "environment": [
      "$defaults",
      "Trusted internal domains: api.internal.example.com",
      "Trusted service: app.agentappbuilder.com, where I send prototypes and screenshots of my apps with demo data"
    ]
  }
}

Three rules from the auto mode configuration reference:

• Put it in ~/.claude/settings.json, in managed settings or in the --settings flag. The classifier ignores autoMode in the project’s .claude/settings.json and .claude/settings.local.json, so a cloned repository cannot trust itself.
• Keep "$defaults". Without it, your list replaces the built-in entries of that section.
• Check the result with claude auto-mode config, which prints what the classifier actually uses.

For patterns rather than destinations, autoMode.allow holds exceptions to the soft block rules. The Auto mode tab of /permissions edits both without opening the file.

Fix 3: retry from /permissions, or leave auto mode

Open /permissions, go to Recently denied, and press r on the action. When you close the dialog, Claude Code tells the model it may retry that call. This is the quickest fix for a single action.

If the classifier blocks 3 times in a row or 20 times in a session, auto mode pauses and Claude Code goes back to asking you; approving the prompted action resumes it. You can also leave auto mode yourself with Shift+Tab and answer the permission prompt for a step you want to approve by hand.

What your message cannot clear

Some boundaries are meant to hold whatever you say:

• permissions.deny rules block before the classifier runs. Neither the classifier nor your intent overrides them.
• hard_deny rules, including the built-in data exfiltration rule, block unconditionally. If a transfer to a host stays blocked after a precise message, the host probably needs to be trusted in environment: sending data to the destinations listed there is allowed by default.
• Ask rules still prompt you, even in auto mode.

And one thing to avoid: asking Claude to try another way. A different command that reaches the same place is the same action, and a workaround defeats the reason you turned auto mode on. Agent guides should say the same thing, as a well written llms.txt does: stop, say which step was blocked, and ask.

Example: the capture step in agentappbuilder

agentappbuilder, a prototype canvas for Claude Code, meets auto mode at one step: the agent installs Playwright outside your repository and sends screenshots of your running app to app.agentappbuilder.com. Both can be blocked, and for good reason.

Its guide is written around that. The agent captures right away only when your own message names both the install and the destination. Otherwise it asks first, in one message (the screens, where they go, that the app must show demo data only, the account it will use), and ends with the exact sentence from Fix 1 for you to send back. If the upload is still blocked, the troubleshooting section gives the autoMode.environment entry shown above, and the FAQ explains why the agent does not add the MCP server itself (Claude Code MCP server setup covers that command). The guide also tells the agent never to work around a block: no other method, no other tool, no retry in another form.