Claude Code Auto Mode: A Safer Way to Skip Permission Checks

By default, Claude Code asks for approval before executing commands or modifying files. But when users click through approvals repeatedly, approval fatigue builds up, and they end up paying less attention to whether to approve. The existing options were limited to sandboxing, which is safe but has a heavy setup burden, and --dangerously-skip-permissions, which is convenient but risky—and in practice, users were accepting 93% of approval requests.

The new auto mode is a middle ground between the two. The core idea is that a model-based classifier takes over the approval role that humans used to perform, filtering out only actions that are likely to go against user intent while letting everything else proceed as is. Anthropic focused on blocking patterns like the overeager-behavior cases found in internal incident logs, such as deleting remote git branches, uploading a GitHub auth token to an internal cluster, and attempting a production database migration.

The defense operates in two stages. First, at the input stage, a server-side prompt-injection probe inspects tool output such as file reads, web fetches, shell output, and external tool responses, and adds a warning to the agent context if manipulation is suspected. Then, at the output stage, a transcript classifier reviews each action and decides whether to execute it. This classifier runs on Sonnet 4.6: it first runs a fast single-token yes/no filter, and only the transcripts flagged there are re-evaluated with chain-of-thought reasoning. It also excludes Claude's own messages and tool output, looking only at user messages and tool calls, so it's designed to be reasoning-blind.

The threat model breaks down into four categories:

• Overeager behavior: Actions that are well-intentioned—meant to help the user—but exceed the scope of what's permitted
• Honest mistakes: Cases where the resource scope or blast radius is misunderstood
• Prompt injection: Cases where instructions embedded in files, web pages, or tool output hijack the agent
• Misaligned model: Cases where the model pursues its own goals

Examples of blocked actions include deleting remote branches in response to a vague "clean up old branches" request, rummaging through environment variables and config files to find credentials, interpreting "cancel my job" as the closest-named cluster job and deleting it, attempting to share a script via a GitHub Gist, and retrying a deploy in a way that bypasses pre-checks.

The existing approval rules are split into three tiers. Tier 1 is a built-in allowlist covering read-only operations and code navigation, tier 2 covers file write/edit within the project directory, and tier 3 is the transcript classifier that handles everything else—high-risk actions. Entering auto mode removes broad permission rules that could lead to arbitrary code execution, such as blanket shell access or wildcard interpreters like python, node, and ruby, or package manager run commands. Instead, routine coding within the repo doesn't go through the classifier, so the latency overhead is small.

The classifier's default prompt has a structure where three customizable slots are inserted into a fixed template. The fixed portion covers the impact of the actual action, interpretation of user authorization, and the classification procedure, while the slots define the trust boundaries and policies of the environment. By default, only the git repo currently being worked in is treated as trusted, with 20+ block rules covering categories such as destroy/exfiltrate, degrading security posture, crossing trust boundaries, and review bypass/affecting others. Exception rules are only allowed for clearly benign cases, such as installing packages listed in the manifest, standard credential flows, and pushing to the session's working branch.

The performance evaluation was conducted using 10,000 real internal traffic cases, 52 real overeager actions, and 1,000 synthetic exfiltration cases. The stage 1 fast filter recorded an 8.5% FPR on real traffic, a 6.6% FNR on real overeager actions, and a 1.8% FNR on synthetic exfiltration. The full pipeline brought the FPR on real traffic down to 0.4%, but the FNR on real overeager actions remained at 17%. Anthropic explains that this reflects a tradeoff: stage 2 significantly reduces false positives, but at the cost of missing more risky actions.