diff --git a/codex-rs/core/src/tools/spec_plan.rs b/codex-rs/core/src/tools/spec_plan.rs
index 211408b9d2..2141f3d30b 100644
--- a/codex-rs/core/src/tools/spec_plan.rs
+++ b/codex-rs/core/src/tools/spec_plan.rs
@@ -1069,7 +1069,7 @@ fn add_core_utility_tools(context: &CoreToolPlanContext<'_>, registry: &mut Tool
             .iter()
             .any(|tool| tool == "send_user_message_async")
     {
-        registry.add(SendUserMessageAsyncHandler);
+        registry.add_with_exposure(SendUserMessageAsyncHandler, ToolExposure::DirectModelOnly);
     }
 
     if environment_mode.has_environment() && features.enabled(Feature::RequestPermissionsTool) {
diff --git a/codex-rs/core/tests/suite/send_user_message_async.rs b/codex-rs/core/tests/suite/send_user_message_async.rs
index d017a4e99e..11f78111f2 100644
--- a/codex-rs/core/tests/suite/send_user_message_async.rs
+++ b/codex-rs/core/tests/suite/send_user_message_async.rs
@@ -5,6 +5,7 @@ use codex_protocol::items::AgentMessageDelivery;
 use codex_protocol::items::AgentMessageItem;
 use codex_protocol::items::TurnItem;
 use codex_protocol::models::MessagePhase;
+use codex_protocol::openai_models::ToolMode;
 use codex_protocol::protocol::EventMsg;
 use codex_protocol::user_input::UserInput;
 use core_test_support::responses::ev_assistant_message;
@@ -52,6 +53,7 @@ async fn send_user_message_async_emits_item_and_does_not_end_the_turn() -> Resul
     .await;
     let test = test_codex()
         .with_model_info_override("gpt-5.2", |model| {
+            model.tool_mode = Some(ToolMode::CodeModeOnly);
             model
                 .experimental_supported_tools
                 .push("send_user_message_async".to_string());