Auto mode for Claude Code · Simon Willison's Weblog
Science, Technology & Innovation · Mar 24, 2026
Claude Code’s new “auto” mode replaces explicit user permission prompts with a model-mediated pre-execution classifier (Claude Sonnet 4.6) that reviews and blocks actions that exceed task scope, touch unrecognized infrastructure, or show signs of hostile influence—creating built-in safeguards and customizable filters but shifting security reliance from deterministic policies to classifier judgment and scope/trust inference.
Auto mode for Claude Code · Simon Willison's Weblog
Science, Technology & Innovation · Mar 24, 2026
Auto mode uses probabilistic intent/environment classifiers that admit false negatives, so it can approve risky steps and should be treated as a filtering layer (defense-in-depth) rather than a deterministic security boundary—run agents in robust sandboxes and use model-based permissioning only as secondary control.
Auto mode for Claude Code · Simon Willison's Weblog
Science, Technology & Innovation · Mar 24, 2026
Anthropic's auto mode embeds a default, transcript-centered policy taxonomy (viewable via `claude auto-mode defaults`) that permits repo-scoped local file ops, safe read-only HTTP/API calls, and manifest-declared dependency installs, while soft-denying scope escalation (e.g., cd to ~/, /etc, other repos), irreversible/destructive actions (force-push, direct pushes to main/master, mass cloud deletions), and executing externally downloaded code—exposing a granular workflow-permissions model based on the starting-repo trust boundary that may not match enterprise trust assumptions.
Auto mode for Claude Code · Simon Willison's Weblog
Science, Technology & Innovation · Mar 24, 2026
The default allow-list permits manifest-driven installs (e.g., pip install -r, npm install) when repository manifests are unchanged, blocking some agent-originated typosquatting but creating a supply-chain blind spot because it doesn't ensure dependencies are pinned, safe, or uncompromised, so evaluation of agent platforms should prioritize deterministic dependency controls (pinning, lockfile enforcement, provenance, network sandboxing) over permission classifiers alone.