Claude’s auto mode skips connector “Always ask” settings

Claude in auto mode read mail through a Fastmail connector whose actions were all set to “Always ask for permission,” Baldassari wrote in an October 20 post on the Baldassari blog. The author reported it to Anthropic as a serious bug. Anthropic replied promptly that this is expected behavior.

It came to light through an ordinary question. A service provider had emailed a link to an unfamiliar platform, so the author asked Claude, “what can you tell me about [platform.com]?” The answer ended by noting that “the service provider that emailed you at 1:59pm today likely uses [platform] to manage projects.”

The exception is written down in one place only: the tooltip on the “Needs Approval” icon, which reads “Claude asks before each use, except in sessions set to Automatically approve.”

In auto mode, a model takes over the approvals. Anthropic’s description of the mode, written for Claude Code, says a classifier reviews each tool call before it runs, looking for destructive actions such as mass file deletion, sensitive data exfiltration or malicious code execution. Safe calls go through, and risky ones are blocked while Claude is steered elsewhere. The engineering post adds that this classifier, running on Sonnet 4.6, sees only user messages and the agent’s tool calls, with tool outputs stripped out. A separate server-side probe scans those outputs, external tool responses included, and attaches a warning when content looks like an attempt to hijack the agent. Anthropic’s stated reason for building all this is approval fatigue: “in practice users accept 93% of them anyway.”

The author’s worry is the lethal trifecta, the case where one agent holds private data, reads untrusted content and can send data out. A crafted message could get Claude to read a 2FA code from the inbox and post it to a website, and email is sensitive even with read-only access. “While I’m sure auto mode would block many of those instances, I am not ready to trust it with this,” the author wrote. Anthropic says much the same: the classifier may still let some risky actions through when user intent is ambiguous or Claude lacks context about the environment.

The author asks for “Always ask” to mean exactly that, or for a fourth option, “Always ask, except in auto mode.” Until one exists, the Fastmail connector is gone from their Claude.