Which AI tools does this work with?

The sources used it with Claude Code.

Where did this come from?

Anthropic Engineering (Anthropic Engineering). Subvolts collected, normalized and credited it; the link above opens the original.

Checklist Coding Agents and automationIntermediate · 5 min

Claude Code auto mode defense layers

Understand the two defense layers in Claude Code's auto mode: input probe and output classifier.

Claude CodeParaphrased

Items

Open in ChatGPT Open in Claude

Input Layer: Server-side prompt-injection probe scans tool outputs (file reads, web fetches, shell output, external tool responses) before they enter the agent's context.
Input Layer: Probe adds a warning to the agent's context if content looks like an attempt to hijack behavior, instructing the agent to treat it as suspect.
Output Layer: Transcript classifier (running on Sonnet 4.6) evaluates each action against decision criteria before execution, acting as a substitute for human approval.
Output Layer Classifier Stage 1: Fast single-token filter decides 'yes' to block or 'no' to allow.
Output Layer Classifier Stage 2: Chain-of-thought reasoning is used only if the first filter flags the transcript, reducing token spend.

Input Layer: Server-side prompt-injection probe scans tool outputs (file reads, web fetches, shell output, external tool responses) before they enter the agent's context.
Input Layer: Probe adds a warning to the agent's context if content looks like an attempt to hijack behavior, instructing the agent to treat it as suspect.
Output Layer: Transcript classifier (running on Sonnet 4.6) evaluates each action against decision criteria before execution, acting as a substitute for human approval.
Output Layer Classifier Stage 1: Fast single-token filter decides 'yes' to block or 'no' to allow.
Output Layer Classifier Stage 2: Chain-of-thought reasoning is used only if the first filter flags the transcript, reducing token spend.

Before or after

before

Context

Understanding the safety mechanisms in Claude Code's auto mode.

What it does and when to use it

This checklist outlines the two main defense layers in Claude Code's auto mode: an input probe that scans tool outputs for prompt injection and an output classifier that evaluates actions before execution. It details the stages within the classifier.

Why it works

The input probe acts as an early warning system against malicious inputs, while the output classifier provides a final check on actions, ensuring they align with user intent and safety protocols.

When not to use it

This is specific to Claude Code's auto mode and not applicable to other tools or general AI usage.

Sources and credit

How we built Claude Code auto mode: a safer way to skip permissions ↗Anthropic Engineering · Anthropic Engineering · May 27, 2026 · paraphrased

First seen on Subvolts May 27, 2026. Updated Sep 11, 2026. Spotted a problem? Tell us.

Where it shows up

How we built Claude Code auto mode: a safer way to skip permissionsAnthropic · Anthropic Engineering · May 27, 2026

Related in the PlaybookPlaybook →

The Playbook: reusable how-tos, prompts, configs and tips pulled out of the news.

Anti-patternOver-reliance on agent auto mode for securityDo not solely rely on agent auto mode for protection against prompt injection. · 10 min
Troubleshooting fixFix privilege escalation via harness allow-rulesExploits target harness allow-rule approval. Review rules carefully to prevent broad access. · 5 min
Safety tipGuard against privilege escalation in coding agentsAdversaries can exploit permission updates to gain broad access. Review rules carefully. · 5 min
HeuristicBalance Claude Code safety and convenience with auto modeUse auto mode to automate permission approvals for Claude Code, reducing fatigue while maintaining safety. · 5 min
RuleBlock arbitrary code execution tools in Claude Code auto modeDisable broad code execution tools when entering auto mode to ensure the classifier sees potentially dangerous commands. · 5 min
HeuristicTiered defenses in Claude Code auto modeUnderstand the three tiers of defense in Claude Code's auto mode for evaluating actions. · 5 min

Questions people ask

Which AI tools does this work with?: The sources used it with Claude Code.
Where did this come from?: Anthropic Engineering (Anthropic Engineering). Subvolts collected, normalized and credited it; the link above opens the original.

Claude Code auto mode defense layers

Questions people ask

OpenAI (ChatGPT)

Google (Gemini)

Anthropic (Claude)

Microsoft (Copilot)

Meta (Meta AI)

xAI (Grok)

Across the six

Subvolts