Is Claude Code Auto Mode Safe? What the Classifier Misses
Updated September 5, 2026
Claude Code auto mode blocked 89% of dangerous commands testers missed. Anthropic's own docs say the classifier never reads tool output. That gap is the answer.
Claude Code auto mode is safer than a human clicking approve, and it is not a security boundary. Anthropic states both. Its own study found testers caught a planted dangerous command 13.6% of the time while auto mode blocked 89% of the same commands. Its own engineering write-up says the classifier never reads tool output. Auto mode therefore raises the floor on careless approvals and leaves one gap open: a command that looks ordinary while the content behind it is hostile. The boundary is the operating system. The classifier is a filter in front of it.
What auto mode is, precisely
A permission mode decides whether Claude Code asks you before an action. In Manual mode it stops and asks before most actions that edit files, run shell commands or reach the network. In auto mode a second model, the classifier, reviews the action instead of you. Anthropic's permission modes documentation lists six modes, and only two of the six describe an enforced limit rather than a review step.
| Mode | What runs without asking | What contains it |
|---|---|---|
default (Manual) | Reads only | You, one prompt at a time |
acceptEdits | Reads, file edits, common filesystem commands | You, for everything else |
plan | Reads, plus classifier-approved commands | A block on edits until you approve a plan |
auto | Everything, with background safety checks | A classifier, running on Claude Sonnet 5 by default |
dontAsk | Only pre-approved tools | Your allowlist, which is an enforced limit |
bypassPermissions | Everything | Nothing, by design |
Two details from that page are worth carrying into the rest of this post. The classifier trusts your working directory and the git remotes configured when the session started, and treats everything else as external. And if the classifier blocks an action three times in a row or twenty times in a session, auto mode pauses and Claude Code goes back to prompting you.
What Anthropic's own numbers say
The figures below are vendor-published research. Anthropic ran the study and Anthropic sells the product, so the method matters more than the result.
In a controlled study published on August 7, 2026, Anthropic recruited 1,053 paid testers through a research vendor and swapped one permission prompt mid-session for a clearly dangerous command. Testers caught it 143 times out of 1,053, or 13.6%. Auto mode blocked 937 of the same 1,053, or 89%. The same post reports 6.3% of manually approved production sessions containing a harmful action against 2.4% of auto mode sessions.
The reason those numbers are so far apart is in the same post: users approve 97% of permission prompts. Approval had stopped being review. Anthropic's earlier engineering write-up on auto mode, published March 25, 2026, puts the approval rate at 93%, so the two figures were measured at different points and neither describes a careful reader.
That engineering post also publishes the miss rate. Against 1,000 synthetic data-exfiltration attempts, the full two-stage classifier pipeline had a false-negative rate of 5.7%. Anthropic's own summary is direct: auto mode "is not a drop-in replacement for careful human review on high-stakes infrastructure."
Auto mode became the built-in starting mode on Pro, Max and Team plans from August 14, 2026.
What the classifier never sees
Here is the design decision that answers the question in the title.
Anthropic's engineering post says the classifier sees user messages and executable tool-call payloads. It strips assistant messages, tool-call descriptions, tool outputs and Claude's own reasoning text, and gives the reason plainly: "we strip assistant text so the agent can't talk the classifier into making a bad call." The permission modes page repeats it for tool results: they are stripped "so hostile content in a file or web page can't manipulate it directly."
That single choice makes the classifier hard to inject and blind to content at the same time. It is a good trade. It is also a documented, permanent limit on what the check can catch. The classifier reviews python3 decode.py. It does not review what decode.py imports, what is sitting in the directory where it runs, or what a previous command wrote there. The same page notes that reads and working-directory edits outside protected paths skip the classifier entirely.
So the honest shape of the answer is not "auto mode is weak". It is that auto mode is a command reviewer, and the interesting attacks are not in the command.
The attack that walked through the gap
On August 26, 2026, Johann Rehberger published a working chain against Claude Code running Opus 5 in auto mode. The starting instruction is to summarize a web page.
- The page answers with HTTP 415, so Claude falls back from the WebFetch tool to
curl. curldownloads a ZIP archive holding encoded files and a decoder binary.- Claude declines to run the unknown binary and writes its own Python decoder instead.
- The decoder runs inside the extracted directory, where a malicious
struct.pyshadows the standard library the momentbase64importsstruct. - Import-time code in
struct.pylaunches a child process that fetches and runs a remote payload.
Every step reads as reasonable in isolation, which is the point. Rehberger reports 3 of 5 trials for the variant that established a callback and 4 of 5 for the variant that wrote files outside the workspace, and says so himself: "These are small samples, not a universal ASR measurement." He also records that Claude noticed the compromise afterwards and auto mode then blocked its cleanup command.
Simon Willison, who linked the writeup on August 27, added a correction on August 30 that is worth keeping: this is better described as a confused environment attack than a classic prompt injection, because the model did not follow instructions from the page. It followed a filesystem it had been handed.
Anthropic closed the report as informative and said the behavior is working as designed. Its position, quoted by Rehberger, is that auto mode is a convenience feature backed by a best-effort classifier rather than a security guarantee, and that the real boundary is OS isolation and network egress control. That answer is consistent with everything in the documentation above.
Does auto mode change how autonomous Claude Code is?
No, and this is where a lot of the commentary goes wrong.
A permission mode changes how often the agent asks. It does not change the surface the agent acts on. This directory classifies Claude Code as Fully Autonomous on the Code environment because the model writes its own shell commands and no fixed list exists to check them against, which is the same test applied to every listing in our three levels of AI agent autonomy. Manual mode does not demote it. Auto mode does not promote it.
What does change with the mode is your exposure per unit of attention. Manual mode spends your attention and gets 13.6% detection for it. Auto mode spends none and gets 89%. Neither number is a containment figure, because neither mechanism contains anything. Only the isolation layer changes the blast radius, and it is configured separately from the permission mode.
What a boundary looks like in this product
Claude Code ships one, and its own page is careful about it. The sandboxing documentation opens its limitations section with a sentence most vendors would cut: "Sandboxing reduces risk but is not a complete isolation boundary."
The Bash sandbox has two independent layers, filesystem isolation and network isolation. It uses Seatbelt on macOS and bubblewrap with socat on Linux and WSL2, with an optional seccomp filter from @anthropic-ai/sandbox-runtime that adds Unix domain socket blocking. WSL1 and native Windows are not supported.
Read the limitations before trusting it with anything:
- The built-in proxy does not terminate or inspect TLS by default. It allows or denies from the client-supplied hostname, so code inside the sandbox can use domain fronting to reach hosts outside your allowlist. Anthropic's own warning names
github.comas a broad domain that creates exfiltration paths. - The sandbox isolates Bash subprocesses only. The Read, Edit and Write tools go through the permission system instead.
- Computer use runs on your real desktop, not in the sandbox.
allowUnixSocketscan hand out an escape. The page uses/var/run/docker.sockas its example, which grants the host.
The security page lists using virtual machines to run scripts and make tool calls as a best practice for untrusted content, and ends the section with a line that belongs in more vendor documentation: "no system is completely immune to all attacks."
Five steps that are worth more than the mode you pick
- Decide what the agent can reach before deciding how often it asks. The permission mode is a UX setting. The isolation is the control.
- Turn on the Bash sandbox with
/sandboxand write a narrow domain allowlist. Name the hosts your build needs. A broad entry is not a policy. - Keep credentials out of the working tree. Rehberger's own advice is the short version: do not expose home directories, SSH keys or cloud credentials to the agent.
- Use deny rules for anything that must never run. Deny rules apply in every mode, including
bypassPermissions. A boundary you state in chat is re-read from the transcript on each check, so context compaction can lose it. A deny rule cannot be lost. - Run unattended work in a container or VM, as a non-root user.
--dangerously-skip-permissionsis blocked as root on Linux and macOS for exactly this reason.
None of these requires leaving auto mode. That is the practical finding: the mode debate and the containment question are separate, and only one of them is load-bearing.
The same question, asked of every other agent you run
This is not a Claude Code problem. It is the shape of every agent that reads content it did not author.
OpenAI Computer Use sits on the Computer-Use environment with no enforced confirmation in the API at all. OpenAI's guide asks you to add one, which tells you the loop does not have one. Browserbase reads untrusted web pages as its entire job, and answers the containment question differently by running the browser in managed cloud infrastructure rather than on your laptop.
MCP servers deserve the same suspicion. Anthropic's security page states that it reviews connectors against listing criteria before adding them to its directory, but "does not security-audit or manage any MCP server." A server is a process on your machine with your permissions, which is worth remembering when you read what an MCP server actually is and how little a badge in a README proves.
If you are deciding whether to run Claude Code unattended, start from the Claude Code listing, where the autonomy level, the pricing and the deployment options are recorded against the date they were verified.
Frequently asked questions
Is Claude Code auto mode safe to leave running?
It is safer than clicking approve, and it is not a boundary. Anthropic closed a working exploit as informative and stated that auto mode is a convenience feature backed by a best-effort classifier, and that the real boundary is OS isolation and network egress control. Leave it running inside a container or VM, not on your daily machine.
What does the Claude Code auto mode classifier actually check?
It reviews the executable payload of a tool call against your request and your stated boundaries. Anthropic's docs say tool results are stripped from what it reads, so hostile content in a file or web page cannot manipulate it. That also means it judges the command, not the data the command will touch.
How do I turn off auto mode in Claude Code?
Start the session with claude --permission-mode default, or set permissions.defaultMode to default in ~/.claude/settings.json. Administrators can remove the mode entirely by setting permissions.disableAutoMode to disable in managed settings, which stops anyone in the organization selecting it.
Does the Claude Code sandbox stop data exfiltration?
Not on its own. Anthropic's sandboxing page says the built-in proxy does not terminate or inspect TLS by default, so it decides from the client-supplied hostname. The page warns that allowing broad domains such as github.com can create exfiltration paths, and that domain fronting can reach hosts outside the allowlist.
Is auto mode the default in Claude Code?
On Pro, Max and Team plans it became the built-in starting mode for new terminal and VS Code sessions from August 14, 2026. Enterprise plans, Console API keys, claude -p runs and Agent SDK sessions still start in Manual mode, whose config value is default.
