How auto mode works with Claude Code

1. 0:00 – 0:44

   Intro

   1. SPSpeaker0:00

      In our research, 97% of permission prompts in Claude Code get approved. These permission prompts appear whenever Claude proposes an action, like running a command, fetching from the web, or editing a file. Approving or denying each one gives you control, but it can lead to approval fatigue, especially on multi-step tasks. So a few months ago, we introduced auto mode. Auto mode checks for potentially harmful actions while letting Claude complete long-running work with fewer interruptions. But if you're no longer approving each action, what determines if it's safe to run? Let's look

2. 0:44 – 3:33

   How auto mode works

   1. SPSpeaker0:44

      at how auto mode works and how you can configure it for your environment and team. It would be easy to assume Claude is now approving its own actions, but that would make Claude its own reviewer, introducing bias through shared context. That's like writing, reviewing, and merging your own pull request. Instead, when Claude proposes an action, it runs through a classifier, a separate check that screens the action and approves or denies it. The classifier sees your messages in Claude's tool calls. It doesn't see Claude's reasoning, responses to you, or tool output, so it isn't influenced by them. It compares each action against your intent and approves the ones that match. What it specifically checks for is Claude reaching beyond what you intended towards something irreversible or destructive, like deleting remote branches when you only asked it to tidy up locally. If the classifier denies an action, Claude usually tries to find a safer way to proceed on its own. For example, if a force push to main gets denied, Claude might try to push to a new branch instead. If it keeps getting denied, auto mode pauses and you approve the action yourself. Any web pages or files Claude reads could carry hidden instructions that try to steer it away from your original intent. So before that content enters Claude's context, a server-side probe scans every tool result for malicious instructions and flags anything suspicious with a warning to treat the content skeptically. Then the classifier checks whether Claude's next action still lines up with what you asked for. So an attack has to clear both layers. We tested this by running prompt injection attacks against Claude Code. With probes and auto mode enabled, the attack success rate in our evaluations dropped to zero. But not every action needs to go through the classifier. Your deny, ask, and allow rules run first. Then a tier check decides which actions the classifier needs to see. Most of what Claude does is read-only or recoverable, like searching your code base or editing files in your project. These actions skip the classifier. On the other hand, riskier operations like shell commands, web fetches, or anything that reaches outside of your environment are sent through the classifier. By default, the classifier only counts your working directory in Git remotes as internal. That means everything else appears external, including your own company's infrastructure.

3. 3:33 – 4:49

   Configuring auto mode

   1. SPSpeaker3:33

      So to get the most out of auto mode, it's worth configuring it. Start by defining your environment. Admins can set this in Manage settings, which every developer in your organization inherits. Developers can add their own entries in User settings, but they can't remove what admins already set. Use the environment field to describe your infrastructure in plain English, such as your GitHub org, cloud buckets, and internal services. Setting environment replaces Claude's built-in entries, so add the default string to keep them. If you need more fine-grained control, use allow for exceptions, soft deny for actions that should be blocked unless you explicitly ask, and hard deny for actions that should be blocked no matter what you ask. These fields are guidance the classifier factors into each check, not hard rules. For hard limits, add deny rules to block matching tool calls and ask rules to force a prompt even in auto mode. Allow rules also work too. But anything broad enough to grant arbitrary code execution is also sent to the classifier. All right,

4. 4:49 – 5:41

   Outro

   1. SPSpeaker4:49

      that's auto mode. We started with a question. If you're no longer approving each action, how are they reviewed? And now you know. A classifier that reads your messages but not Claude's, a tier check that reserves it for actions that are hard to undo, a probe that scans it for hidden instructions, and a trust boundary that you configure. Together, they catch what manual human reviews might miss. When you are rolling it out, start narrow. Watch what gets denied, and then widen it from there. For high-stake operations like changes to your production infrastructure, you should review Claude's actions yourself or build your own evals to gain more confidence. To learn more about our safety research, read our blog post linked below.

Episode duration: 5:41