The context pollution happens when a denial triggers but the model still keeps attempting the harmful action via alternative avenues. It's got nothing to do with the auto-mode eval model's actual output.

I have never seen that happen before. What I see is a mention that the classifier stopped it from doing X and it then asks for explicit permission or gives me the command to run myself.