I found it worthwhile reading how auto mode works[0]. The short version is that the classifier only sees user messages and the tool call. So if your agents communicate via tool calls, the classifier doesn’t see that text at all (or any other prompt injection) and will block a potentially dangerous command.

[0] https://www.anthropic.com/research/claude-code-auto-mode

auto mode is a bad joke