Claude Code auto mode: how the classifier works and how to control it

What is Claude Code auto mode?

Claude Code auto mode is a permission mode where Claude acts without routine permission prompts while a separate classifier model reviews each risky action before it runs. The official permission modes docs say the classifier blocks "anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read."

With Claude Code v2.1.283 or later, auto mode is the built-in starting permission mode for interactive terminal and VS Code sessions, unless a flag or setting picks another mode. claude -p runs and the Agent SDK start in Manual mode instead. For the bigger picture of rules and modes, read our Claude Code permissions guide.

The docs add a clear warning: "Auto mode reduces permission prompts but does not guarantee safety. Use it for tasks where you trust the general direction, not as a replacement for review on sensitive operations."

How does the auto mode classifier decide?

Every action goes through a fixed decision order, and the first matching step wins:

1. Your rules first. Actions that match your allow, ask or deny rules resolve at once. Deny blocks, and content-scoped ask rules such as Bash(git push *) still prompt you. There are exceptions: writes to protected paths still go to the classifier, and no allow rule approves recognized rm or rmdir removals of critical paths.
2. Safe actions skip review. Read-only actions and file edits in your working directory are approved without the classifier, except writes to protected paths and the first read outside your working directories, which prompts you.
3. Everything else goes to the classifier. Shell commands, network calls, subagent tasks and similar actions are reviewed.
4. Blocks come back with a reason. If the classifier blocks, Claude receives the reason, in most sessions the name of the rule it matched, such as [Data Exfiltration].

When you enter auto mode, broad allow rules that grant arbitrary code execution are dropped for the duration: blanket Bash(*) or PowerShell(*), wildcarded interpreters like Bash(python*), package-manager run commands, and Agent and Monitor allow rules. Narrow rules like Bash(npm test) stay in effect, and the dropped rules come back when you leave auto mode.

The classifier sees your messages, Claude's tool calls other than read-only lookups, and your CLAUDE.md content. In the classifier requests Claude Code sends itself, tool results are stripped, so hostile text in a file or web page cannot talk to the classifier directly. Subagents are checked three times: when the task is handed off, on each action while they run, and when their report comes back.

By default the classifier runs on Claude Sonnet 5. On a direct connection to the Anthropic API and on cloud providers, Claude Code can instead have the server review actions as part of the normal model requests, depending on version and rollout. The cost and latency notes cover the details.

What does auto mode block and allow by default?

The classifier trusts your working directory and the git remotes configured when the session started. Everything else counts as external until you configure it.

The full lists are long and change between releases. Run claude auto-mode defaults to print them as JSON, or claude auto-mode config to see what the classifier actually uses with your settings applied.

Two behaviors are easy to miss. First, boundaries you state in the chat count: if you say "don't push until I review", the classifier blocks matching pushes until you lift it. Those boundaries are not stored as rules, though, and can be lost if compaction removes the message, so use a deny rule for a hard guarantee. Second, approvals must be specific. "You can force-push" clears nothing; naming the action and the branch does.

How do you turn auto mode on or off?

Auto mode needs to be available to your session: a supported model, an organization that has not disabled it, and no disableAutoMode setting. When it is available:

Note that "defaultMode": "auto" does not take effect from a project's .claude/settings.json or .claude/settings.local.json; put it in ~/.claude/settings.json. Administrators who want auto mode gone for everyone set disableAutoMode in managed settings, which removes it from the cycle. In the status bar, an active auto mode shows as ⏵⏵ auto mode on. For the keys themselves, see our Claude Code keyboard shortcuts guide.

To start every session on your machine in Manual mode instead:

{
  "permissions": {
    "defaultMode": "default"
  }
}

Which settings tune auto mode?

The autoMode block in settings tells the classifier about your environment. Per the auto mode configuration docs, it is read from ~/.claude/settings.json, managed settings, and the --settings flag or Agent SDK, but never from project settings files, so a checked-in repo cannot loosen your rules.

• autoMode.environment: the main one. List trusted repos, source control orgs, buckets, domains and internal services. Include "$defaults" to keep the built-in entries.
• autoMode.allow: exceptions to soft block rules, for routine actions that keep getting flagged.
• autoMode.soft_deny: extra destructive actions to block, which explicit user intent can still clear.
• autoMode.hard_deny: boundaries that block unconditionally.
• autoMode.classifyAllShell: set to true to send every shell command to the classifier, ignoring Bash and PowerShell allow rules while in auto mode.

Setting environment, allow, soft_deny or hard_deny without "$defaults" replaces the built-in list for that section, so keep the string in each list you add to unless you mean to take over the whole list.

{
  "autoMode": {
    "environment": [
      "$defaults",
      "Source control: github.example.com/acme-corp and all repos under it",
      "Trusted internal domains: *.corp.example.com"
    ]
  },
  "permissions": {
    "ask": ["Bash(git push *)", "Bash(gh pr create *)"]
  }
}

The permissions.ask lines above add a human checkpoint before pushes and pull requests while leaving auto mode on for everything else. You can also run /auto-mode-setup to have Claude Code draft environment entries from your project and recent sessions, then review and save them.

What are the limits of auto mode?

• Supported models only. On the Anthropic API and Claude Platform on AWS: Claude Opus 4.6 or later, Sonnet 4.6 or later, Haiku 5.5 or a Fable model. On Amazon Bedrock, Google Cloud's Agent Platform and Microsoft Foundry: Sonnet 5 or later, Opus 4.7 or later, Haiku 5.5 and the Fable models. If the model is not supported, the session starts in Manual.
• Fallback after repeated blocks. If the classifier blocks 3 times in a row or 20 times in total, auto mode pauses and Claude Code goes back to prompting. These thresholds are not configurable. Blocked actions appear in /permissions under Recently denied, where r retries with manual approval.
• No verdict means no action. If a classifier check fails, Claude Code denies the action rather than running it unreviewed.
• Cost and latency. On Enterprise plans and on accounts using the Claude API, Bedrock, Agent Platform, Foundry or Claude Platform on AWS, classifier calls count toward token usage, and each check adds a round trip.
• Some actions are never auto-approved. Tools matched by an explicit ask rule, tools that need user interaction, and recognized critical-path removals such as rm -rf ~ are not auto-approved in any mode.

Auto mode and the Bash sandbox work independently and combine well: the classifier decides whether an action should run, and the sandbox limits what it can reach. If you want Claude to explore before it changes anything, plan mode is the better fit.

Keep your boundaries written down

Auto mode reads CLAUDE.md and your messages, so clear written instructions matter more than ever. If you reuse the same task briefs with stated boundaries, such as "don't push, open a draft PR", Kipt keeps them as Markdown prompts in a private GitHub repo you own, with {{name}} blanks for the parts that change.