Claude Code Auto Mode: What It Blocks and Allows

Claude Code auto mode lets Claude work without routine permission prompts. Instead of asking you, Claude Code sends risky-looking actions to a second model, the classifier, which approves or blocks each one before it runs. On Claude Code v2.1.283 or later, auto mode is the built-in starting mode for interactive terminal and VS Code sessions, so if Claude stopped asking you for permission recently, this is why.

What you need to know:

• Reads and edits in your project run freely. Shell commands, network calls and writes outside the project go to the classifier. Reads outside the project aren't classifier-reviewed: the first one prompts you in interactive sessions, and after you allow it later reads run without a prompt.
• The classifier blocks things like curl | bash, force pushes, production deploys and sending secrets outside the repo.
• It is not a safety guarantee. Anthropic says so in the docs and in the launch post.
• Leaving it takes one key. Shift+Tab switches to Manual, and permissions.defaultMode changes where sessions start.

This guide goes deep on auto mode alone, based on Anthropic's permission modes documentation as of October 2026. For all six modes and the allow, ask and deny rule syntax, see our Claude Code permissions guide.

What Claude Code auto mode does

Before auto mode, you had two bad choices. Approve every shell command by hand, or skip permissions entirely with --dangerously-skip-permissions. Anthropic's auto mode announcement pitches it as the middle path: longer tasks with fewer interruptions, and less risk than skipping checks.

Every action goes through a fixed decision order, and the first match wins:

1. Your rules first. Allow, ask and deny rules from your settings resolve immediately. An ask rule still prompts you. A deny rule still blocks.
2. Safe actions skip review. Read-only actions and file edits inside your working directory are auto-approved, except writes to protected paths such as .git and .claude. The first Read, Grep or Glob outside your working directories prompts you instead. If you choose to keep allowing them, later outside reads run without a prompt and without classifier review. Background sessions and -p runs skip that first prompt entirely. To refuse those reads in every session, set permissions.blockReadsOutsideWorkingDirectories to true.
3. Everything else goes to the classifier. Shell commands that aren't read-only, web requests, MCP tools and writes outside the project.
4. A block comes with a reason. Claude gets the rule it hit, such as [Data Exfiltration], and is pushed to try a different approach.

The classifier runs on a separate model. By default that's Claude Sonnet 5, according to the docs, though your setup can change it.

Two details make it harder to fool than it sounds. In the classifier requests Claude Code sends, tool results are stripped out, so a hostile instruction hidden in a file or web page can't talk to the classifier directly. And a separate server-side probe scans incoming tool results for suspicious content before Claude reads them. Anthropic's engineering write-up on auto mode covers how these layers fit.

Auto mode also nudges Claude to keep working instead of stopping for clarifying questions. Claude still asks when your prompt or a skill explicitly relies on it.

Rules that change when you enter auto mode

Broad allow rules that grant arbitrary code execution are dropped while auto mode is on: blanket Bash(*), wildcarded interpreters like Bash(python*), package-manager run commands, and Agent allow rules. Narrow rules like Bash(npm test) stay. Claude Code restores the dropped rules when you leave. So if your old allowlist pre-approved all of Python, auto mode quietly takes that back.

What auto mode blocks and what it lets through

The classifier trusts your working directory and the git remotes configured when the session started. Everything else counts as external until you say otherwise.

That's a sample. The full block list runs to dozens of entries, including disabling CI checks, toggling production feature flags, opening tunnels to the public internet, and commenting out tests that guard auth. Run this to print every rule as JSON:

claude auto-mode defaults

Two items on the allowed side surprise people. Auto mode will push to your repo's branches, including the default branch, and will open a pull request that matches your request. A branch named like a deploy target, such as production or gh-pages, gets judged separately. If you want a human checkpoint before any push, add an ask rule:

{
  "permissions": {
    "ask": [
      "Bash(git push *)",
      "Bash(gh pr create *)"
    ]
  }
}

Ask rules are checked before the classifier, so these always prompt. One limit: a rule matches the command as written, so git -C repo push slips past it. For a stricter checkpoint, the docs point to a PreToolUse hook.

Saying "don't" and "go ahead" in chat

The classifier reads your conversation. Tell Claude "don't push until I review" and matching actions get blocked, even ones the defaults allow. The boundary holds until you lift it.

The catch: boundaries aren't stored as rules. The classifier re-reads them from the transcript on each check, so context compaction can delete the message that set one. For anything that matters, write a deny rule.

Approvals work the same way in reverse, with a stricter bar. You have to name the action and the thing that makes it risky. "You can force-push" clears nothing. "Force-push the feature/login branch" does, for that one action.

Teaching it your infrastructure

If the classifier keeps blocking routine work, like pushing to your company's GitHub org or writing to a team bucket, it's missing context. The auto mode configuration docs cover the autoMode.environment setting for listing trusted repos, buckets and domains, plus /auto-mode-setup, which drafts those entries for you. Check what the classifier actually uses with claude auto-mode config.

Auto mode vs acceptEdits vs bypassPermissions

People searching "claude code auto accept" usually mean one of three modes. They are very different.

acceptEdits is "auto accept edits." It approves file edits in your working directory plus a fixed set of filesystem commands: mkdir, touch, rm, rmdir, mv, cp and sed. Everything else still prompts. It's predictable because it's dumb. No model decides anything.

auto makes a judgment call on everything else. That's both its strength and its weak point. It runs your test suite and installs your dependencies without asking, and it can also be wrong.

bypassPermissions approves everything except a short list of hard-coded exceptions. The docs say it offers no protection against prompt injection or unintended actions. Anthropic's announcement calls auto mode a safer long-running alternative to it, and that's the honest comparison: if you were using --dangerously-skip-permissions to stop the prompts, auto mode is the upgrade.

How to turn auto mode on or off

Switch mid-session

Press Shift+Tab. From auto mode, the first press goes to Manual (default), and the cycle then runs default, acceptEdits, plan, and back to auto. Cycling into auto needs no confirmation.

In VS Code, click the mode indicator under the prompt box and pick Manual, Edit automatically or Auto.

There's also a shortcut into auto mode. On v2.1.247 or later, a Bash permission prompt in Manual or acceptEdits mode offers Yes, and switch to auto mode when auto mode is available.

Start a session in a specific mode

For one session, use the flag:

claude --permission-mode default

manual works as an alias for default. To start every terminal session on your machine in Manual mode, set this in ~/.claude/settings.json:

{
  "permissions": {
    "defaultMode": "default"
  }
}

The settings scope matters more than usual here:

• "auto" only works from user settings. A defaultMode of auto in a project's .claude/settings.json or .claude/settings.local.json doesn't take effect, so a repository can't opt you into auto mode.
• Other values, except bypassPermissions, work from project settings for terminal sessions, so a team can make a sensitive repo start in Manual.
• VS Code is different. claudeCode.initialPermissionMode doesn't accept auto, and the extension never reads project settings for the starting mode.

Turn it off for an organization

Administrators can set permissions.disableAutoMode to "disable" in managed settings. That removes auto from the Shift+Tab cycle, and a session started with --permission-mode auto falls back to Manual.

Non-interactive runs

claude -p and Agent SDK runs start in Manual mode, not auto. On v2.1.302 or later, calls that need approval are denied unless an allow rule, hook or callback approves them. To get classifier review in a script, pass --permission-mode auto explicitly. Our headless mode guide covers the rest of -p.

Who can use auto mode

Per the permission modes page, auto mode needs all of these:

Older models, including Sonnet 4.5, Opus 4.5 and Haiku 4.5, aren't supported on any provider. If the session can't use auto mode, Claude Code starts it in Manual instead. Anthropic can also switch auto mode off server-side, in which case it stays off until you start a new session.

On older versions, auto was the built-in start only on Pro, Max and Team plans. The launch post shows how fast this moved: auto mode began as a research preview on the Team plan and became generally available for all Claude Code users on July 10, 2026.

Anthropic's caveats, and the limits worth knowing

Anthropic is unusually direct about what auto mode doesn't do. The launch post says it reduces risk compared with skipping permissions but doesn't eliminate it, and still recommends isolated environments. It names the failure modes:

• It can allow risky actions when your intent is ambiguous, or when Claude lacks context about your environment to know an action is risky.
• It can block harmless ones. False positives are expected, especially on custom infrastructure.
• It costs a little. Anthropic says it may have a small impact on token use, cost and latency for tool calls.

The docs add the operational details:

• Repeated blocks hand control back. Three blocks in a row or 20 in a session pause auto mode, and Claude Code starts prompting again. The thresholds aren't configurable. Blocked actions appear under Recently denied in /permissions, where r retries one with your manual approval.
• Classifier calls bill on some accounts. On Enterprise plans and on Claude API, Claude Platform on AWS, Bedrock, Agent Platform and Foundry accounts, classifier calls count toward token usage, mostly from shell and network actions, since reads and project edits skip the classifier.
• Subagents get checked three times. At spawn, during each action, and when they report back. A subagent's own permissionMode frontmatter is ignored.
• Deleting critical paths still prompts. Recognized rm and rmdir removals of critical paths, like rm -rf ~, aren't auto-approved in any mode.

The practical upshot: auto mode is a good default for work you'd approve anyway. For anything you can't undo, keep an ask or deny rule in place, and know where Claude Code's undo stops.

If the terminal isn't your place

Auto mode exists because approving every command gets old fast, and that tension is part of working with a coding agent on your own machine. If you're not tuning permission modes at all, Taku is a different shape: an AI-native desktop workspace where you mirror an AI setup someone already got working and run it, without reproducing their environment first. Taku is in Beta, and the Mac app is available now.

FAQ

What is auto mode in Claude Code?

A permission mode where a separate classifier model reviews actions instead of you. Reads and project edits run freely (the first read outside the project prompts you once in interactive sessions); shell commands, network calls and outside writes are checked and blocked if they look risky.

Is auto mode the default in Claude Code?

Yes, on v2.1.283 or later, for interactive terminal and VS Code sessions, as long as your model and organization allow it. claude -p and Agent SDK runs start in Manual mode.

How do I turn off auto mode in Claude Code?

Press Shift+Tab to switch to Manual for the session. To start in Manual every time, set permissions.defaultMode to "default" in ~/.claude/settings.json, or launch with claude --permission-mode default.

What's the difference between auto mode and auto-accept edits?

Auto-accept edits is acceptEdits mode. It approves file edits and a few filesystem commands, and prompts for everything else. Auto mode lets a classifier approve or block every other action too.

Is Claude Code auto mode safe?

Safer than --dangerously-skip-permissions, not safe in an absolute sense. Anthropic says the classifier can allow risky actions when intent is ambiguous and recommends isolated environments. Back it with deny rules for anything irreversible.

Why does auto mode keep blocking a normal command?

Usually the classifier doesn't know your infrastructure is trusted. Check /permissions for the denial, then list your repos, buckets or domains in autoMode.environment, or run /auto-mode-setup.