One more point I left out of the report, and I think it is the most serious consequence: consent fatigue.
The classifier errors give no reason, so every approval prompt looks the same, whether it is a harmless read or a sensitive action. In one session I approved prompts on 108 transcript lines, mostly for small read-only calls. The same flow also asked me to approve deleting a local folder, reading an authenticated secrets-manager session, and downloading a file that might contain credentials. After dozens of reasonless prompts, I approve by habit, which defeats the purpose of Auto-review. I even added a user rule that marks “Authorized: run this call” as the recommended answer and ended up having classifier think that I am trying to bypass auto-review step using prompt injection attack and see approval gate in every MCP call. The safety check now trains users to stop reading the prompts it shows.
Expected: approval prompts appear only for calls the classifier actually judged risky, and each prompt states why, so a routine read is easy to tell from a sensitive action.