Claude Code Auto Mode

Claude Code auto mode replaces the approval prompts that users were already accepting 93% of the time with a series of automatic checks, and most actions never reach a model at all (Anthropic research). Anthropic lets tools that cannot change anything, such as file reads, searches and code navigation, run from a fixed allowlist alongside the user's own always-allow rules, and it lets file writes and edits inside the project directory through because version control keeps them reviewable. Switching into auto mode drops user rules known to grant arbitrary code execution, such as blanket shell access or wildcarded interpreters like python and node, so the model-based check described next still sees the commands most capable of causing damage, though Anthropic calls that list best-effort and inevitably incomplete. Everything else, including shell commands, web fetches, external tool integrations, subagent spawns and file operations outside the project, goes to a transcript classifier running on Sonnet 4.6. Its first stage gives a single yes-or-no answer and is told to err toward blocking. Only when that stage flags an action does a second stage reread the same input with step-by-step reasoning, which exists to clear false alarms.

The classifier sees only the user's messages and the tool calls Claude makes. Anthropic strips Claude's own messages so the agent cannot talk the classifier into a bad call, and strips tool outputs because that is where planted instructions (prompt injection) enter; a request to post environment variables to an outside URL fails the user-intent test regardless of which file suggested it. The price is provenance: if a user never named a job ID, the classifier cannot tell whether Claude found it in a query or made it up. Anthropic reports that adding Claude's messages and tool results lowered performance on its test set of overeager actions, where Claude is trying to help but goes further than the user would approve. To cover the content the classifier never reads, a separate server-side probe scans tool outputs before Claude sees them and attaches a warning when something looks like a hijacking attempt. The classifier's central test is authorization, so a request to "clean up my branches" does not authorize a batch delete. A blocked action returns to Claude as a denial with an instruction to find a safer path, and after 3 consecutive denials or 20 in total the session stops and escalates to the human.

Anthropic's own evaluation puts the main gap in that authorization judgment. On 10,000 real tool calls from its employees, the first stage alone blocked 8.5% of benign actions and the full pipeline blocked 0.4%. That cleanup has a cost: on 52 real overeager actions, collected from sessions where an employee denied the action or it was flagged afterward, the miss rate rose from 6.6% after the first stage to 17% for the full pipeline, and on 1,000 synthetic data-exfiltration attempts it rose from 1.8% to 5.7%. Anthropic calls the 17% "the honest number". In most of the misses it examined, the classifier recognized the danger, such as a force-push or a deletion, but accepted something that only looked like consent, for example a user saying "clean up the PR", which does not mention force-pushing, or an earlier approval of a similar action. Anthropic says prompt changes have not produced a fix that gains more than it costs. It describes auto mode as a substantial improvement over running with --dangerously-skip-permissions, the flag that turns off every permission prompt, arguably a regression for someone who carefully approves every action, and no drop-in replacement for careful human review on high-stakes infrastructure. The overeager sample is small because each example required Claude to attempt something dangerous in a real session.

This research page repeats the opening sections of Anthropic's earlier engineering post on how it built auto mode. Anthropic's account of how it contains Claude says auto mode catches roughly 83% of overeager behaviors before they execute, and argues that because model-layer defenses like this will never be fully effective, they need containment behind them, such as sandboxes and egress controls that limit what the agent can reach.