Anthropic launches auto mode in Claude Code: false blocks drop to 0.4%

Claude Code users approve 93% of permission prompts, which means manual approval has long since turned into a reflexive "Approve." Anthropic is trying to eliminate that effect with auto mode, where model-based classifiers make the decisions. On 10,000 real tool calls from company employees, the full pipeline mistakenly blocks only 0.4% of safe actions. But on genuinely dangerous episodes it misses 17%, and Anthropic says so plainly in its write-up.

Why an intermediate mode is needed

Users currently have two ways to get rid of excess confirmations. The first is a sandbox. It is safe, but it needs to be configured for each new capability, and anything that requires network or host access breaks the isolation. The second is the --dangerously-skip-permissions flag, which disables all prompts and protects against nothing. Manual confirmations sit in the middle, but because of approval fatigue they offer little benefit.

Anthropic's internal incident log shows what exactly there is to fear. An agent deleted remote git branches because it misunderstood a command. It uploaded an engineer's GitHub token to an internal compute cluster. It tried to run migrations against a production database. In every case the model was not trying to cause harm; it was being overeager. This pattern is described in the Claude Opus 4.6 system card.

How the protection works

There are two layers. On the input side, a server-side probe inspects tool outputs (file reads, web requests, shell output, responses from external services) before they reach the agent's context. If the content looks like an attempt to hijack the agent, a warning is attached to it: treat the source as suspicious and stick to the user's original task.

On the output side, a transcript classifier running on Sonnet 4.6 does the work. It operates in two stages: a fast single-token "block or not" filter, followed by chain-of-thought reasoning, but only for what the first stage flagged. The classifier sees only user messages and tool calls. Claude's own replies and outputs are stripped out, so by design it does not see the agent's reasoning.

Decisions are made across three tiers:

• Tier 1: a built-in list of safe tools (reading, search, navigation) and user-defined rules. When entering auto mode, rules that grant arbitrary code execution are dropped: blanket shell access, interpreters such as python, node and ruby with wildcards, and launches through package managers.
• Tier 2: file edits inside the project go through without the classifier, since they can be reviewed via version control.
• Tier 3: everything else, from shell commands and web requests to spawning subagents and operations outside the project directory, goes to the classifier.

The classifier evaluates the real effect of an action, not the text of the command. If the agent writes a payload to a file and then runs it, the payload is what gets checked. A chain joined with && counts as a single action. A script that assembles a shell command is evaluated by the assembled result. Anything the agent chose on its own is considered unauthorized until the user says otherwise. A request to "clean up branches" does not grant permission for mass deletion, and a question like "can we fix this?" does not count as an instruction.

By default, only the current git repo is treated as trusted. There are more than twenty block rules, grouped into four themes: data destruction and exfiltration, weakening security, crossing trust boundaries, and bypassing review or affecting others. You can view the list with the command claude auto-mode defaults.

Numbers and limitations

Anthropic tested the pipeline on three sets: 10,000 real calls from employees, 52 real cases of overeagerness, and 1,000 synthetic data exfiltration attempts, some of them obfuscated.

• Stage 1 (fast filter): 8.5% false positives on real traffic; 6.6% misses on real dangerous actions; 1.8% on synthetic exfiltration.
• Full pipeline (stage 1 and stage 2): 0.4% false positives; 17% misses on real dangerous actions; 5.7% on synthetic exfiltration.

The second stage cleans up false blocks, but at the cost of recall: some dangerous actions get through. The sample of 52 cases is small, because it requires Claude to attempt something dangerous in a live session and a human to record it. The write-up in the original text breaks off right at the discussion of these 17%, but Anthropic does not hide the figure itself.

How to use it

Auto mode does not replace a sandbox where a mistake is costly: on production infrastructure and with real secrets, isolation is more reliable. In other cases, the mode looks like a sensible replacement for the blind skip-permissions flag. Before enabling it, check your own allow rules: it will strip broad interpreter rules regardless. Trusted GitHub organizations, cloud buckets and internal APIs need to be specified in the settings. Otherwise, any transfer outside the repo will be treated as a potential leak. Anthropic advises editing the default values rather than writing a configuration from scratch.