How we built Claude Code auto mode: a safer way to skip permissions
Source
anthropic.com
Author
Anthropic Engineering
Date
Why it matters
It shows how to move beyond binary 'ask every time' vs 'YOLO mode' permission systems by using cheap classifiers to gate risky tool calls in real time, giving engineers building agentic coding tools a concrete blueprint for catching prompt injectionAn attack that hides instructions in content an AI will read — a webpage, email, or document — tricking it into following the attacker instead of the user.Full definition → and unintended actions without approval fatigue.
Terms in this piece · Glossary
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
context window — The maximum amount of text a model can consider at once — its working memory for the current conversation or task.
chain-of-thought — Having a model write out intermediate reasoning steps before its answer, which markedly improves performance on hard problems.
prompt injection — An attack that hides instructions in content an AI will read — a webpage, email, or document — tricking it into following the attacker instead of the user.
Key quotes
“Claude Code users approve 93% of permission prompts. We built classifiers to automate some decisions, increasing safety while reducing approval fatigue.”
“Sandboxing is safe but high-maintenance: each new capability needs configuring, and anything requiring network or host access breaks isolation.”
“Auto mode uses two layers of defense: one for what Claude reads, one for what Claude does.”
