Claude Code Auto Mode

Canonical version: Claude Code Auto Mode.

Auto mode is a permission mode in Claude Code where Claude makes permission decisions on behalf of the user, with a background classifier reviewing each action before it runs. It sits between the default mode (approve everything) and bypassPermissions / --dangerously-skip-permissions (approve nothing). Announced 2026-03-24. Available as a research preview.

How it works

Before each tool call executes, a separate classifier model (Sonnet 4.6, regardless of the session model) evaluates the pending action against the conversation context and decides whether to allow or block it. Claude's own text and tool results are stripped from classifier input, so hostile content in files or web pages cannot manipulate the classifier directly. The classifier also receives CLAUDE.md content, so project instructions factor into decisions.

Decision order for each action:

1. Actions matching explicit allow/deny rules resolve immediately
2. Read-only actions and file edits within the working directory are auto-approved
3. Everything else goes to the classifier
4. If the classifier blocks, Claude receives the reason and tries an alternative

On entering auto mode, Claude Code drops broad allow rules that would bypass the classifier: blanket Bash(*), wildcarded interpreters like Bash(python*), package-manager run commands, and any Agent allow rule. Narrow rules like Bash(npm test) carry over. Dropped rules are restored when leaving auto mode.

What the classifier blocks by default

The classifier trusts the working directory and configured git remotes. Everything else is treated as external until configured otherwise.

Blocked by default:

• Downloading and executing code (curl | bash, scripts from cloned repos)
• Sending sensitive data to external endpoints
• Production deploys and migrations
• Mass deletion on cloud storage
• Granting IAM or repo permissions
• Modifying shared infrastructure
• Irreversibly destroying pre-session files
• Destructive source control operations (force push, pushing to main)

Allowed by default:

• Local file operations in the working directory
• Installing dependencies from lock files/manifests
• Reading .env and sending credentials to their matching API
• Read-only HTTP requests
• Pushing to the current branch or one Claude created

View the full default rule lists with claude auto-mode defaults.

Subagent handling

The classifier evaluates subagent tasks at spawn time. Dangerous task descriptions are blocked before the subagent starts. Inside a subagent, auto mode runs with the same block/allow rules; any permissionMode in the subagent's frontmatter is ignored. When the subagent finishes, the classifier reviews its full action history and prepends a security warning if anything looks off.

Fallback behavior

If the classifier blocks an action 3 times consecutively or 20 times total in a session, auto mode pauses and Claude Code resumes prompting for each action. Approving a prompted action resets the denial counters. In non-interactive mode (-p flag), repeated blocks abort the session.

Cost and latency

Classifier calls count toward token usage. Each checked action sends a portion of the conversation transcript plus the pending action to the classifier. Read-only actions and working-directory file edits skip the classifier, so the overhead mainly applies to shell commands and network operations.

Availability and setup

Requires Team plan (Enterprise and API rolling out). Works with Sonnet 4.6 and Opus 4.6 only. Not available on Haiku, claude-3 models, or third-party providers (Bedrock, Vertex, Foundry). With the release of Claude Opus 4.7, Auto mode was also extended to Max users.

For admins: enable in Claude Code admin settings. Disable with "disableAutoMode": "disable" in managed settings. Disabled by default on Desktop; toggle via Organization Settings.

For developers:

• CLI: claude --enable-auto-mode, then cycle to it with Shift+Tab
• VS Code / Desktop: enable in Settings, then select from the permission mode dropdown
• As a default: set "defaultMode": "auto" in permissions settings
• Non-interactive: claude -p "task" --permission-mode auto

Configuring trusted infrastructure

If auto mode blocks routine actions (pushing to your org's repo, writing to a company bucket), the classifier doesn't recognize those as trusted. Admins can configure trusted repos, buckets, and services via the autoMode.environment setting in managed settings. See Claude Code Permissions for details.

References

• Announcement: https://claude.com/blog/auto-mode
• Permission modes docs: https://code.claude.com/docs/en/permission-modes
• Classifier configuration: https://code.claude.com/docs/en/permissions#configure-the-auto-mode-classifier

Related

• Claude Code
• Claude Code Permissions
• Claude Code Interactive Mode
• Claude Code Hooks
• Claude Code Configuration
• Claude Opus 4.7

About Sébastien

I'm Sébastien Dubois, and I'm on a mission to help knowledge workers escape information overload. After 20+ years in IT and seeing too many brilliant minds drowning in digital chaos, I've decided to help people build systems that actually work. Through the Knowii Community, my courses, products & services and my Website/Newsletter, I share practical and battle-tested systems.

I write about Knowledge Work, Personal Knowledge Management, Note-taking, Lifelong Learning, Personal Organization, Productivity, and more. I also craft lovely digital products and tools.

If you want to follow my work, then become a member and join our community.

Ready to get to the next level?

If you're tired of information overwhelm and ready to build a reliable knowledge system:

• 📚 KM for Beginners — 10+ hours of structured video lessons
• 🚀 Obsidian Starter Kit — Ready-made vault with 40+ templates
• 💼 Knowledge Worker Kit — Complete guides + lifetime community
• 🦉 1-on-1 Coaching — Personalized guidance
• 🎯 Join Knowii — Community + ALL courses & tools