Claude Code auto mode is here! Goodbye to endless permission prompts!

Hey everyone, it's Shiichan! Today I found something Claude Code users are going to love: a new auto mode that lets an AI safely auto-approve permission requests for you!

Anthropic Engineering anthropic.com

What was announced?

On Anthropic's Engineering blog, the team shared how they built Claude Code's new auto mode. It lets an AI classifier decide which permission requests to approve automatically, instead of asking you to confirm every single action.

Because it's the Engineering blog, this isn't just a "here's a new feature" note. They walk through the architecture and the design choices behind making it safe, which is the fun part!

The story so far

Until now, Claude Code asked you to confirm things like running a command or editing a file every time. That's safe, but when there are a lot of prompts, you get approval fatigue. In fact, Anthropic found that users accepted 93% of permission prompts anyway, so it often turned into clicking "yes."

The alternative, skipping everything with --dangerously-skip-permissions, is far too risky. Auto mode fills the gap between those two extremes: a safer way to skip permissions.

What changes

You no longer have to hand-approve every action. Safe ones get through automatically, while risky ones still get checked. And the defaults are conservative, so you can start using it without configuring anything.

Safe operations like file reads and searches stay allowed, in-project file edits pass without classifier review, and only riskier actions like shell commands and outbound network calls go through the classifier. It's a three-tier setup.

Dive Deep

Auto mode is built from two defensive layers:

• Input layer: tool outputs like file reads, web fetches, and shell output are scanned server-side before they enter the agent's context, and warnings are added if hostile content (prompt injection) is found.
• Output layer: a classifier (Sonnet 4.6) evaluates each agent action.

The classifier works in two stages. Stage 1 is a fast single-token filter that decides "allow or block," and only when something looks off does Stage 2 kick in with chain-of-thought reasoning. Fast and careful at the same time, which is a nice design!

Here's a neat detail: the classifier deliberately sees limited information. It looks only at user messages and the bare tool-call commands, and strips the agent's prose and tool outputs. That prevents the agent from talking the classifier into a bad call, and it strengthens injection defenses.

The decision criteria are thoughtful too. You can customize the environment trust boundary (the default is only the current git repo) and block rules across four categories: destroy or exfiltrate, degrade security, cross trust boundaries, and bypass review.

The behavior when something is blocked is clever. Instead of stopping, the agent receives the denial as a tool result with an instruction to find a safer alternative (deny-and-continue). If it's denied 3 times in a row or 20 times total, the session escalates. Classifiers also run when work is handed to subagents and when results come back, so an injection mid-run can still be caught.

The team is honest about performance, too. On 10,000 real-traffic samples, the full pipeline's false-positive rate (FPR) was 0.4%. On 52 real overeager actions, the false-negative rate (FNR) was 17%. Anthropic is candid about that:

Whether 17% is acceptable depends on what you're comparing against

And they stress that auto mode is

not a drop-in replacement for careful human review on high-stakes infrastructure

So for critical infrastructure, human review still matters.

If you want to see the rules, run claude auto-mode defaults to view the full list.

Wrap-up

• Claude Code now has auto mode, where an AI safely auto-approves permission requests!
• The motivation is approval fatigue; users accepted 93% of permission prompts.
• Safety comes from two defensive layers plus a three-tier permission system.
• The classifier (Sonnet 4.6) runs in two stages and deliberately sees limited info to resist injection.
• The pipeline FPR on real traffic was 0.4%, and the FNR on overeager actions was an honestly reported 17%.

This one is for developers tired of endless permission prompts, and for anyone curious about safe agent design!