Balance Claude Code safety and convenience with auto mode
Use auto mode to automate permission approvals for Claude Code, reducing fatigue while maintaining safety.
Auto mode is a new mode for Claude Code that delegates approvals to model-based classifiers—a middle ground between manual review and no guardrails.
This approach aims to catch dangerous actions not aligned with user intent, while allowing safe actions to run without approval prompts. It uses two layers of defense: an input layer probe for prompt injection and an output layer classifier for action evaluation.
Instead of manually approving every command, auto mode handles routine approvals, freeing the user to focus on critical decisions.
Claude Code's auto mode automates permission approvals using classifiers. It balances safety and convenience by distinguishing between dangerous and routine actions, reducing user fatigue from constant manual approvals.
It uses a two-layer defense system: an input probe to scan tool outputs for prompt injection and an output classifier to evaluate actions before execution. This allows safe actions to proceed without prompts while blocking potentially harmful ones.
This mode is not suitable if you require absolute, granular control over every single command execution and cannot tolerate any automated decision-making.
- How we built Claude Code auto mode: a safer way to skip permissions ↗Anthropic Engineering · Anthropic Engineering · May 27, 2026 · paraphrased
First seen on Subvolts May 27, 2026. Updated Sep 11, 2026. Spotted a problem? Tell us.
- How we built Claude Code auto mode: a safer way to skip permissionsAnthropic · Anthropic Engineering · May 27, 2026
The Playbook: reusable how-tos, prompts, configs and tips pulled out of the news.
- Anti-patternOver-reliance on agent auto mode for securityDo not solely rely on agent auto mode for protection against prompt injection. · 10 min
- Troubleshooting fixFix privilege escalation via harness allow-rulesExploits target harness allow-rule approval. Review rules carefully to prevent broad access. · 5 min
- Safety tipGuard against privilege escalation in coding agentsAdversaries can exploit permission updates to gain broad access. Review rules carefully. · 5 min
- RuleBlock arbitrary code execution tools in Claude Code auto modeDisable broad code execution tools when entering auto mode to ensure the classifier sees potentially dangerous commands. · 5 min
- ChecklistClaude Code auto mode defense layersUnderstand the two defense layers in Claude Code's auto mode: input probe and output classifier. · 5 min
- HeuristicTiered defenses in Claude Code auto modeUnderstand the three tiers of defense in Claude Code's auto mode for evaluating actions. · 5 min
Questions people ask
- Which AI tools does this work with?
- The sources used it with Claude Code.
- Where did this come from?
- Anthropic Engineering (Anthropic Engineering). Subvolts collected, normalized and credited it; the link above opens the original.