The one-line version: somewhere in the 2.1.205 → 2.1.222 releases, Claude Code stopped asking you to approve borderline commands and started letting a model decide. That's the right move for anyone running agents unattended — but it means your safety floor is now a classifier, and a classifier is a filter, not a fence. The best evidence for both halves of that sentence is in the same changelog: the features that widened the classifier's authority, and the bug fixes that show exactly where it leaked.

If you run Claude Code headless — in CI, as a background fan-out orchestrator, or in any pipeline with no human to click "approve" — this is the layer that decides what your agent is allowed to touch. Here's what moved, and what you should keep underneath it.

What moved: static analyzer → classifier#

Auto mode's whole premise is that a background classifier evaluates each tool call so you don't approve every one by hand. Two releases widened what it adjudicates. In 2.1.205, plan-mode-with-auto stopped prompting for Bash commands "the static analyzer can't prove read-only" and handed them to the classifier. In 2.1.216, the dangerous-rm, background-&, and suspicious-Windows-path checks "no longer open permission dialogs; the auto-mode classifier adjudicates them instead."

That's a real philosophical shift. The old gate was a static analyzer: a deterministic check that either proved a command read-only or bounced it to a human. Its weakness was over-asking and an inability to reason about intent — it can't tell a safe rm from a catastrophic one, so it asks. The classifier can reason about context the analyzer can't. But it trades determinism for judgment, and judgment has a distribution of outcomes.

The leaks are in the changelog#

You don't have to speculate about where a probabilistic boundary fails, because Anthropic patched the failures in public. There are two shapes, and both matter.

False allow — the bypass. A command that should have prompted, ran. 2.1.214 fixed Bash permission checks "treating zsh variable subscripts and modifiers in [[ ]] comparisons as inert text." 2.1.221 fixed a sharper version: a bypass "where zsh could execute hidden commands in [[ ]] regex conditionals." Both now prompt. The pattern — shell metasyntax smuggling execution past a check that read it as a string — is the classic way a permission layer gets fooled, and it slipped through twice.

A false deny stalls your pipeline. A false allow runs the thing you built the gate to stop. The changelog shows both happened.

False deny — the outage. 2.1.221 also fixed "auto mode denying commands with 'HTTP 401' classifier errors after the OAuth token expired or rotated mid-session." Read that carefully: the classifier itself failed a network call, and the failure surfaced as a blanket denial. It fails safe — a denial can't run anything dangerous — but for an unattended pipeline, a mid-run token rotation silently blocking every command is an outage you'll debug at 2 a.m.

And the surface is still expanding. 2.1.222 started routing SendMessage content — messages one agent sends to another agent session — through the permission classifier, and fixed PreToolUse auto-allow hooks "bypassing tool restrictions in background agent tasks." Inter-agent messaging is now part of the trust boundary, which tells you the boundary is growing faster than any one prompt could cover.

Why this is still the right call#

None of this is an argument against the classifier. Prompting a human for every borderline Bash command is a non-starter for headless runs, and a pure static analyzer either blocks too much or waves through commands it can't reason about. A model that adjudicates in context, pauses to manual approval after a run of blocks, and gets its edge cases patched in weekly releases is a better default than either extreme. Anthropic is clearly treating the classifier as a living security surface — the density of fixes is a feature, not a warning.

The mistake would be to treat it as the boundary rather than a layer.

The founder checklist: keep these deterministic#

A classifier reduces prompts. It does not replace the guardrails that don't depend on a model guessing right. Before you run Claude Code unattended, put three deterministic layers underneath it:

Then log every tool call. The classifier's job is to spare you the prompts, not to be the only thing standing between a smuggled rm and your repo. Set the allowlist, keep the sandbox, scope the creds — and let the model do the adjudicating it's genuinely good at.