I had the same issue with Codex, where one day it just became unusable.

Weirdly, this would occur with very common commands like git push, where the classifier would start to yap about not being able to verify the repository's privacy settings.

My bug reports went ignored, the issue continued, and I eventually just switched to Full access.

I have not yet encountered an issue with Claude's Auto mode.

What works in that case is adding a message saying "I authorise you to do $thing", which the classifier treats as explicit consent to do something and execute commands toward that goal.