Claude Code launches Auto Mode for AI agents

Claude Code adds Auto Mode, an option that lets you work without manually approving every action while maintaining an automated system to block commands that appear dangerous or unauthorized.

Anthropic is trying to solve a straightforward problem: Claude Code asks for permission before executing commands or modifying files. That protection works, but it forces you to click "approve" many times. Over time, approval fatigue sets in: you accept almost everything without reviewing it carefully.

According to Anthropic, users end up accepting 93% of requests. The current alternatives are inconvenient: use an isolated environment that requires constant configuration, or enable --dangerously-skip-permissions, an option that removes all warnings and lets the agent act without barriers.

Auto Mode aims for the middle ground. Claude can move forward autonomously while other models review its actions before they are executed.

Two layers to reduce risk

The system analyzes both the information Claude receives and the actions it tries to take.

The first layer operates when Claude reads files, visits a website, runs a command or receives information from another tool. A detector installed on the server looks for signs of prompt injection, meaning content designed to trick the agent into ignoring the user's request.

If it finds something suspicious, it adds a warning to Claude's context. For example, if a page contains instructions to upload secrets to an external server, the agent is told to treat that content with suspicion and refocus on the original request.

The second layer reviews the action Claude wants to execute. A classifier based on Sonnet 4.6 analyzes user messages and tool calls, but it cannot see Claude's own explanations or the results returned by tools. This prevents the agent from trying to convince the reviewer that a dangerous action is safe.

Not everything goes through the reviewer

Auto Mode divides actions into three levels:

• Safe actions: reading files, searching for text, browsing code or managing a task list. These are allowed without additional review.
• Changes within the project: editing or creating files in the current repository. These are considered routine operations and can be reviewed later through version control.
• Actions with real-world impact: running commands, accessing files outside the project, making web requests, using external integrations or starting subagents. These go through the classifier.

When you enable Auto Mode, Claude Code also removes some overly broad rules that could allow arbitrary code execution. For example, general permissions to run any Python, Node or Ruby script. More specific rules, such as allowing a particular formatter, can remain in place.

The classifier also tries to interpret the scope of what you authorized. Saying "clean up my branches" does not automatically mean allowing the mass deletion of branches. Likewise, asking "can we fix this?" is not interpreted as an order to change production infrastructure.

The results show the limits

Anthropic tested the system with real-world traffic, dangerous actions triggered by overly impulsive agent behavior and synthetic data exfiltration tasks.

In real-world traffic, the complete system incorrectly blocked 0.4% of legitimate actions. But it also allowed 17% of dangerous actions in the test set focused on agent initiative errors. In the synthetic data exfiltration tests, the rate of undetected dangerous actions was 5.7%.

The 17% figure is the most important for understanding what Auto Mode offers. Anthropic acknowledges that the classifier usually identifies the danger, but sometimes misinterprets whether the user authorized an action with that scope. An ambiguous request or a previous approval can look like evidence of consent even when it is not.

That is why Auto Mode does not replace careful human review in critical systems. It is primarily designed as an improvement over running Claude with --dangerously-skip-permissions, not as a guarantee that it can operate unsupervised in production.

What happens when it blocks something

A block does not necessarily stop the entire session. Claude receives the rejection as the tool's result and must look for a safer alternative instead of trying to evade the restriction.

If it accumulates three consecutive blocks or 20 blocks in total, the system stops the model and requests human intervention. In headless mode, run with claude -p, the process ends directly.

For you, the practical change is fewer interruptions when delegating programming tasks, but also a new responsibility: choosing carefully when to let the agent act. Auto Mode reduces the risk of full autonomy, but it does not eliminate it. Anthropic will continue expanding its tests because the next challenge is not only detecting dangerous commands, but correctly interpreting what you authorized and how far that authorization extends.