At a glance
WHAT IT’S REALLY ABOUT
Claude Code auto mode uses classifiers, probes, configurable trust boundaries
- Auto mode reduces “approval fatigue” by allowing Claude Code to proceed with fewer permission prompts while still screening for harmful actions.
- Instead of Claude approving its own work, a separate classifier evaluates proposed actions using only the user’s messages and tool-call data, not Claude’s reasoning or tool outputs.
- A server-side probe scans tool results (like web pages or file contents) for prompt-injection attempts before that content enters Claude’s context, creating a second defense layer.
- A tiering system sends only higher-risk, harder-to-undo actions (e.g., shell commands, web fetches, external operations) to the classifier, while many read-only/recoverable actions bypass it.
- Admins and developers can configure the trust boundary (internal vs external resources) and rules (allow/ask/deny, soft vs hard guidance) to match organizational infrastructure and risk tolerance.
IDEAS WORTH REMEMBERING
5 ideasAuto mode shifts review from humans to an independent safety check, not to Claude itself.
Actions are screened by a separate classifier to avoid “self-review” bias; it inspects user intent via messages/tool-call data while ignoring Claude’s reasoning and tool outputs.
Safety is enforced through two complementary layers: probe then classifier.
Tool outputs are scanned server-side for hidden instructions (prompt injection) before entering context, and the classifier then verifies subsequent actions still match the user’s intent.
Only higher-risk actions are classifier-gated; many routine actions are not.
Read-only or recoverable operations like searching a repo or editing project files usually bypass the classifier, while shell commands, web fetches, and external-reaching actions are escalated.
Default “internal” boundaries are narrow, so configuration is essential for real organizations.
By default, only the working directory and Git remotes count as internal; without adding your company infrastructure, many normal actions will be treated as external and scrutinized or denied.
Environment text and soft/hard guidance shape classifier decisions, but rule types differ in enforceability.
Environment/allow/soft deny/hard deny fields guide classifier judgment, while explicit deny rules and ask rules are the hard mechanisms to block or force prompts even in auto mode.
WORDS WORTH SAVING
5 quotesIn our research, 97% of permission prompts in Claude Code get approved.
— Unknown
Auto mode checks for potentially harmful actions while letting Claude complete long-running work with fewer interruptions.
— Unknown
It would be easy to assume Claude is now approving its own actions, but that would make Claude its own reviewer, introducing bias through shared context.
— Unknown
We tested this by running prompt injection attacks against Claude Code. With probes and auto mode enabled, the attack success rate in our evaluations dropped to zero.
— Unknown
When you are rolling it out, start narrow. Watch what gets denied, and then widen it from there.
— Unknown
High quality AI-generated summary created from speaker-labeled transcript.
