How to Fix Claude Code Error: temporarily unavailable, so auto mode cannot determine the safety of bash
Issue
Working in Claude Code's auto mode (automatic permission approval mode), a tool call is suddenly blocked, and the terminal shows a prompt like:
error: claude-opus-5[1m] is temporarily unavailable, so auto mode cannot determine the safety of bash right now. wait a moment and then try this action again. if it keeps failing, continue with other tasks that don't require this action and come back to it later. note: reading files, searching code, and other read-only operations do not require the classifier and can still be used.
The model name could be claude-opus-4-8, claude-sonnet-4-6, claude-sonnet-5, claude-fable-5, or third-party models like glm-5.3, k3; the bash position could be write, edit, webfetch, websearch, skill, croncreate, or even an MCP tool name; the reason in parentheses could be timed out, server error, rate-limited, connection failed, or no parentheses at all. These are all the same issue, handled the same way, with a complete variant lookup provided below.
Root Cause: It's the 'Classifier' That's Down, Not Your Command Being Judged Dangerous
The essence of auto mode is to replace 'manual confirmation' with 'model classifier': before executing actions with side effects like Bash or writing files, Claude Code makes an additional restricted model call, making the session model act as a security monitor (the system prompt starts with 'You are a security monitor for autonomous AI coding agents'), outputting only a danger score. We previously captured and parsed this classification request in full using a local log proxy; for mechanism details, refer to that article.
Understanding the mechanism, this error is easy to comprehend:
- The error indicates that this classifier call failed—the model service is temporarily unavailable/timed out/rate-limited, and the score cannot be obtained.
- When the score cannot be obtained, Claude Code chooses 'better not to act'—neither allowing nor judging, letting you retry later. So this is not a safety judgment on your command (the new error message even directly states 'This is not a judgement about the action').
- Read-only operations (reading files, searching code) do not require classification and thus still work normally—this also explains why it's always actions like bash/write/edit that get stuck.
Solution: Try These Four Steps in Order
- Wait a few seconds and retry as is. Most cases are transient fluctuations in the model service (especially common during peak times), and retrying once or twice usually works.
- Do something else first. Let Claude continue with read-only tasks (reading code, analyzing, planning), then come back in a few minutes to execute the blocked action—this is exactly what the error message recommends.
- Still failing: Switch session model. The classifier uses your session model—switch to another available model with
/model, and the classifier will switch accordingly. Ifclaude-opus-5is overloaded, switching toclaude-sonnet-5often recovers immediately. The same applies when using third-party routing (when the error mentions names likeglm-5.3,k3): switch back to the official model or a healthy backend. - Still not working: Exit auto mode. Switch back to default permission mode (manual confirmation for each action), so the classifier is no longer in the path, and actions execute normally—the trade-off is that you have to click confirmation yourself. After confirming this batch of work, switch back to auto.
There's a related error: 'error: auto mode could not evaluate this action and is blocking it for safety'—this is similarly a conservative block when the classification step fails to provide a conclusion, handled the same way as above.
Variant Lookup: Is This What You're Seeing?
Compare the three slots below; if the sentence matches, it's the issue described in this article:
Model Name Slot (who is acting as the classifier):
claude-opus-5[1m] / claude-opus-4-8[1m] / claude-sonnet-4-6[1m] / claude-sonnet-5 / claude-fable-5[1m] / glm-5.3[1m] / k3[1m] / model-sonnet[1m] / any other model ID. The [1m] suffix just indicates that the model has a 1M context window and is unrelated to this error.
Action Slot (which tool is blocked):
the safety of bash / write / edit / webfetch / websearch / skill / agent / croncreate / mcp__<service-name>__<tool-name>—any tool with side effects could appear here.
Reason Slot:
(timed out) / (server error) / (rate-limited) / (connection failed) / no parentheses—corresponding to timeout, 5xx error, rate limiting, connection failure, with no difference in handling.
FAQ
Is my command being judged dangerous?
No. Dangerous commands have a different set of prompts (interception when the classifier is working normally). This error explicitly states that the classifier cannot connect, unrelated to command content—even when the model is overloaded, harmless write operations like mkdir tmp will trigger it.
Why does this error occur when using GLM/Kimi?
When connecting Claude Code to third-party models via routers like claude-code-router or one-api, the classifier call also goes through your configured backend. When the third-party backend is unstable, the corresponding model name appears in this error. The solution is the same: switch to a healthy backend or official model.
Why are read-only operations unaffected?
The classifier only handles actions with side effects (executing commands, writing files, sending requests). Operations like reading files or searching code don't change any state and don't require classification by design, so they work normally even when the classifier is down.
How does this classifier actually work?
In short: a restricted call of the session model, with a 116,000-character system prompt, two-level rules (HARD BLOCK / SOFT BLOCK / ALLOW) plus two-stage classification. Full packet analysis see Packet Capture Analysis of Claude Code Auto Mode Classifier; to know the real boundaries of this classifier (and how it can be bypassed by injection chains), see Reproducing an Injection Chain That Breaks Through Claude Code Auto Mode.
Lessons Learned
When encountering errors in AI toolchains, first distinguish between 'classification failure' and 'being judged as bad'—the former is an infrastructure issue (wait/retry with a different path), while the latter is a content issue (change the plan). The wording of this error actually has the answer in it, but when a large block of red text appears in the terminal, most people (including us) first react with 'what did I do wrong'.