allowed exploits - auto-pick-up