What Claude Code's auto mode approves, and how to turn it off

If you've opened Claude Code recently and noticed it stopped asking before running commands, that's not a bug. With Claude Code v2.1.283 or later, auto mode is the built-in starting permission mode for interactive terminal and VS Code sessions, according to Anthropic's permission modes docs. Here's what changed, what it still stops, and how to go back to approving things yourself.

What auto mode is

Claude Code has several permission modes. In Manual mode (shown as default in settings), Claude stops and asks before most file edits, shell commands and network calls. In auto mode, the docs say, "a second model, the classifier, reviews actions instead of you".

The classifier is meant to block anything that "escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read". Explicit ask rules you've written still force a prompt.

Not every action goes to the classifier. Reads and edits inside your working directory, outside protected paths, skip it. Shell commands, network calls and other actions get checked.

Anthropic is direct about the limits: "Auto mode reduces permission prompts but does not guarantee safety. Use it for tasks where you trust the general direction, not as a replacement for review on sensitive operations."

When it became the default

Anthropic first announced on Aug 7, 2026 that auto mode would become the default for Pro, Max and Team plans, and added an Oct 22, 2026 update saying it was rolling out as the default for new sessions in most Claude apps on those plans. The current docs go further: on v2.1.283 or later it's the starting mode for interactive terminal and VS Code sessions "on every plan and provider".

Exceptions, per the docs:

• HIPAA organizations start in Manual mode (Claude Code v2.1.285 or later), with auto mode still available to switch to.
• Non-interactive runs. From v2.1.302, claude -p and Agent SDK runs with no mode set start in Manual mode, and calls that need approval are denied unless an allow rule, hook, canUseTool callback or permission-prompt tool approves them.
• Unsupported models. On the Anthropic API, auto mode needs Opus 4.6 or later, Sonnet 4.6 or later, Haiku 5.5 or a Fable model.

What it blocks by default

Anthropic's docs list the default rules. A sample of what's blocked:

• Downloading and executing code, like curl | bash
• Sending sensitive data to external endpoints
• Production deploys and migrations, and mass deletion on cloud storage
• Granting IAM or repo permissions, or modifying shared infrastructure
• Force push, plus git reset --hard, git checkout -- ., git clean -fd and git stash drop
• terraform destroy and its Pulumi and CDK equivalents
• Writing to a secret manager or changing DNS records or TLS certificates
• Merging a pull request no human has approved, or disabling CI checks
• Printing a live credential into the transcript or a file
• Flags that disarm a safety guard, like --insecure
• Opening a pull request against a different repository or organization, unless you named it

And what's allowed by default:

• Local file operations in your working directory
• Installing dependencies declared in your lock files or manifests
• Reading .env and sending credentials to their matching API
• Read-only HTTP requests
• Pushing to any branch of the repository you're working in, including the default branch. Branches named as deploy targets, such as production or gh-pages, are judged separately.

That last one surprises people. If your main deploys on push, auto mode will not stop a push to it by default. Branch protection on your remote, or a deny rule, is what stops it. Run claude auto-mode defaults to print the full lists as JSON.

Two more details matter. When you enter auto mode, Claude Code drops broad allow rules that amount to arbitrary code execution, such as Bash(*), and restores them when you leave. Narrow rules like Bash(npm test) stay. And if the classifier blocks something 3 times in a row or 20 times in a session, auto mode pauses and Claude Code goes back to asking you.

How it handles prompt injection

The docs say the classifier requests Claude Code sends itself include your messages, Claude's tool calls and your CLAUDE.md, but tool results are stripped, "so hostile content in a file or web page can't manipulate the classifier directly". A separate server-side probe scans incoming tool results and flags suspicious content before Claude reads it. Our guide to MCP security covers why that matters for tools that read outside content.

How to turn it off

Pick the one that matches how long you want it off:

1. For this session: press Shift+Tab. From auto, the first press switches to Manual and the status bar shows ⏸ manual mode on. Keep pressing to cycle through accept-edits and plan mode.
2. For one launch: run claude --permission-mode default.
3. For every session: add this to ~/.claude/settings.json:

{
  "permissions": {
    "defaultMode": "default"
  }
}

In VS Code, set claudeCode.initialPermissionMode to default in your user settings. That setting doesn't accept auto at all.

4. Remove it entirely: set permissions.disableAutoMode to "disable" in a settings file. That takes auto out of the Shift+Tab cycle, and a launch with --permission-mode auto starts in Manual instead. Administrators can set it in managed settings to remove auto mode for the whole organization.

One gotcha in the other direction: per the docs, setting "auto" as the default in a project's .claude/settings.json or settings.local.json doesn't take effect, so a repository's checked-in settings can't start you in auto mode.

What it costs

Each classifier check sends part of the transcript plus the pending action, adding a round trip before the action runs. By default those requests go to Claude Sonnet 5. On Enterprise plans and on Claude API, Bedrock, Google Cloud and Microsoft Foundry accounts, the docs say classifier calls count toward your token usage. If you're watching spend, our tokenizer explainer shows why the same transcript can cost more on newer models.

Anthropic's case for it

Anthropic's argument is that people stop reading prompts. Its blog says users approve 97% of permission prompts in Claude Code. In a controlled study with 1,053 paid testers, Anthropic reports that human reviewers caught dangerous commands 13.6% of the time, while auto mode blocked 89% of the same commands. In red-team testing with Apollo Research, it says the classifier's miss rate fell from 12% to 7%. These are Anthropic's own numbers, and a 7% miss rate on adversarial attacks is still a miss rate.

Should you keep it on?

Auto mode is a reasonable default for local work in a repo you trust. For anything touching production, credentials or shared infrastructure, add the layers that don't depend on a model's judgment: deny rules, branch protection and a sandbox or container. Our guide to running coding agents safely walks through all three, and Claude Code subagents, skills and hooks shows how hooks can enforce rules the classifier only infers. Anthropic's newer Claude Duet app raises the same question about how much an agent should do without asking.

And whatever mode you're in, don't rely on telling Claude "don't push". The docs say those boundaries are re-read from the transcript and "can be lost if context compaction removes the message that stated it". A deny rule doesn't forget.