Claude Code's auto mode classifier blocks author's own probe twice with 'Exfil Scouting'

The author's earlier article counted only static boundaries visible in configuration files, such as a five-minute workflow timeout and a session's repository access scope. The two refusals he encountered came from a different layer — the execution platform itself — which he had not examined when concluding there were zero dynamic mechanisms. Because both commands were stopped before any byte left the network or any local output was returned, the classifier is acting before execution rather than reacting to observed behavior. Notably, the second command had no network component and was a routine read in a repository he can write to, yet it drew the identical 'Exfil Scouting' label, which the author suggests may mean the layer watches for a broader pattern of probing behavior rather than network egress alone. He is careful to note that this is an observation of two cases, that he did not retry by other means, that the classifier's internal logic is undisclosed, and that a single find does not prove sufficient defense. He also distinguishes this black-box layer from a published monitoring design like Nvidia's Sentry, saying the two should not be equated.