Claude Code Auto Mode

What it is

Auto Mode, a Claude Code permission mode that replaces manual approve/deny prompts with two model-based classifier layers. The post's actionable content is the tiered gating that decides which actions even reach the classifier, and a behavior change engineers must know: entering auto mode silently drops broad permission rules you may already rely on.

How it works

Two defense layers. Input: a server-side prompt-injection probe scans tool outputs (file reads, web fetches, shell output, external tool responses) before they enter context; on suspected hijack it injects a warning telling the agent to anchor on the user's actual request. Output: a transcript classifier on Sonnet 4.6 evaluates each action, stage 1 a fast single-token yes/no filter tuned to err toward blocking, stage 2 chain-of-thought only if stage 1 flags. The classifier is reasoning-blind by design: it sees only user messages and the agent's tool calls — Claude's own messages and tool outputs are stripped out.

Actions are gated by three tiers before reaching the classifier:

flowchart TD
    A[Agent action] --> B{Tier 1: safe-tool<br/>allowlist / user rules}
    B -- match --> P[Allow, no classifier]
    B -- no --> C{Tier 2: file write/edit<br/>inside project dir}
    C -- yes --> P
    C -- no --> D[Tier 3: transcript classifier]
    D --> S1{Stage 1 single-token}
    S1 -- no --> P
    S1 -- yes/flag --> S2[Stage 2 CoT re-eval]
    S2 --> R[Allow or Block]

Tier 3 sees shell commands, web fetches, external tool integrations, subagent spawns, and out-of-project filesystem operations.

Preconditions / Affected

Applies to anyone switching Claude Code into auto mode. Relevant if you previously set broad always-allow rules for convenience (blanket shell access, wildcarded interpreters like python/node/ruby, package-manager run commands).

What to do

• Know that on entering auto mode, permission rules granting arbitrary code execution are dropped — blanket shell, wildcarded interpreters, and package-manager run commands. This is best-effort and admittedly incomplete, so don't assume every dangerous blanket rule is caught.
• Narrow rules (e.g. "allow running code formatters") carry over; broad interpreter escapes do not — restructure allowlists toward narrow patterns.
• Configure the classifier's three policy slots (what's trusted in your environment, what to block, what exceptions to carve out) inserted into a fixed shipped template; defaults ship out of the box and can be extended iteratively.

Caveats

The post states plainly that the dropped-rules list is best-effort and "any list will inevitably be incomplete." The classifier is tuned specifically to overeager behavior and honest mistakes (with internal test examples), though the block defense is said to apply regardless of threat source. Manual prompts are accepted 93% of the time — the baseline this replaces is not close scrutiny.