Claude Code auto mode, a new permissions feature from Anthropic, gives the AI coding assistant the ability to make permission decisions on behalf of users while a separate classifier model monitors actions before they execute.
The feature serves as an alternative to the existing --dangerously-skip-permissions flag. Anthropic said the classifier runs on Claude Sonnet 4.6, regardless of which model powers the main coding session.
How the Classifier Works
Before each action runs, the classifier reviews the full conversation and determines whether the action matches the user’s original request. It blocks actions that escalate beyond the task scope, target unrecognized infrastructure, or appear driven by hostile content from a file or web page.
Developers can inspect the default ruleset by running claude auto-mode defaults in the terminal. The command outputs a full JSON configuration covering allowed, soft-denied, and blocked action categories.
Claude Code Auto Mode Default Rules
The default allow list covers read-only API calls, local file operations within project scope, and installation of packages already declared in manifest files such as requirements.txt or package.json. However, it does not cover agent-chosen package names, which carry typosquatting and supply chain risk.
The soft-deny list flags actions such as force-pushing to Git repositories, pushing directly to default branches, downloading and executing code from external sources, and mass-deleting files on cloud storage services including S3, GCS, and Azure Blob.
Limitations and Security Concerns
Anthropic’s own documentation acknowledges that the classifier may still allow some risky actions, particularly when user intent is ambiguous or when the model lacks sufficient context about the environment. The non-deterministic nature of AI-based classifiers means outcomes cannot be guaranteed.
Security researchers have noted that the default allow list permits pip install -r requirements.txt, which would not protect against supply chain attacks involving unpinned dependencies. A separate incident involving LiteLLM highlighted this risk on the same day the feature launched.
“The classifier may still allow some risky actions: for example, if user intent is ambiguous, or if Claude doesn’t have enough context about your environment to know an action might create additional risk.”
Anthropic, Claude Code Documentation
The Case for Deterministic Sandboxing
Critics of the approach argue that prompt-based protections are inherently less reliable than deterministic sandboxes. A robust sandbox restricts file access and network connections at the operating system level, producing consistent and verifiable results regardless of model behavior.
Moreover, the auto mode classifier defines “project scope” strictly as the repository in which the session started. Accessing directories such as ~/, ~/Library/, or /etc is classified as scope escalation and triggers a block. This boundary is enforced by the classifier rules, not by the underlying operating system.
Consequently, the feature represents a usability improvement over the existing skip-permissions flag, but it does not replace the security guarantees that a fully isolated execution environment provides. Anthropic has not stated whether a native sandboxing option is planned for future releases of Claude Code.
