Back to feed

Auto mode for Claude Code

Simon Willison's Weblog

Mar 24, 2026

3/24/2026

Claude Code Auto Mode Introduces Model-Mediated Pre-Execution Review With Classifier Safeguards

Auto mode for Claude Code · Simon Willison's Weblog

Science, Technology & Innovation · Mar 24, 2026

Claude Code’s new “auto” mode replaces explicit user permission prompts with a model-mediated pre-execution classifier (Claude Sonnet 4.6) that reviews and blocks actions that exceed task scope, touch unrecognized infrastructure, or show signs of hostile influence—creating built-in safeguards and customizable filters but shifting security reliance from deterministic policies to classifier judgment and scope/trust inference.


3/24/2026

Auto Mode Security Is Probabilistic Filtering, Not A Primary Containment

Auto mode for Claude Code · Simon Willison's Weblog

Science, Technology & Innovation · Mar 24, 2026

Auto mode uses probabilistic intent/environment classifiers that admit false negatives, so it can approve risky steps and should be treated as a filtering layer (defense-in-depth) rather than a deterministic security boundary—run agents in robust sandboxes and use model-based permissioning only as secondary control.


3/24/2026

Auto Mode Implements A Policy Taxonomy Distinguishing Allowed Project-Scoped Operations From Risky Or Destructive Actions

Auto mode for Claude Code · Simon Willison's Weblog

Science, Technology & Innovation · Mar 24, 2026

Anthropic's auto mode embeds a default, transcript-centered policy taxonomy (viewable via `claude auto-mode defaults`) that permits repo-scoped local file ops, safe read-only HTTP/API calls, and manifest-declared dependency installs, while soft-denying scope escalation (e.g., cd to ~/, /etc, other repos), irreversible/destructive actions (force-push, direct pushes to main/master, mass cloud deletions), and executing externally downloaded code—exposing a granular workflow-permissions model based on the starting-repo trust boundary that may not match enterprise trust assumptions.


3/24/2026

Auto Mode Reduces Some Dependency Risk but Leaves Broader Repository Dependency Risk, Highlighting the Need for Deterministic Dependency Controls

Auto mode for Claude Code · Simon Willison's Weblog

Science, Technology & Innovation · Mar 24, 2026

The default allow-list permits manifest-driven installs (e.g., pip install -r, npm install) when repository manifests are unchanged, blocking some agent-originated typosquatting but creating a supply-chain blind spot because it doesn't ensure dependencies are pinned, safe, or uncompromised, so evaluation of agent platforms should prioritize deterministic dependency controls (pinning, lockfile enforcement, provenance, network sandboxing) over permission classifiers alone.