Auto mode is now the default in Claude Code

Join the discussion

• Hacker News
• >We hired 1,053 paid testers through a research vendor for a coding study.

  >The testers caught the dangerous command just 13.6% of the time (143 of 1,053), while auto mode blocked 89% of the same commands (937 of 1,053). Head to head, auto mode blocked 800 commands that a human approved, while humans blocked only 6 that auto mode allowed. As sessions got longer, humans did worse: they blocked about 17% of dangerous commands early in a session, dropping to about 5% after 50 or more prior prompts, while auto mode's block rate stayed flat regardless of session length.

  Any note on the proficiency, expeirence, and skill levels of the testers? 'cos the diff in numbers is absurdly high.

  by ta-run
• Before auto mode came out, I had a script that ran before every permission request, it called Haiku with a prompt with a list of safe and unsafe command examples and asked it to classify as safe/unsafe and log it so I can review it later. It worked really well for me until auto mode came out, at which point I preferred the provider's built-in classifier versus maintaining my own.

  I've been using auto mode ever since the feature was released. Apart from a very few occassions where the classifier blocked a safe command, I have faced no issues and continue using it as my default mode. It's great!

  by prtmnth
• For small projects where I don't wish to interact with Claude so much, I've started using Anthropic's sandbox runtime utility "srt":

  https://github.com/anthropic-experimental/sandbox-runtime

  This is combined with "auto" mode.

  Seems to work so far. I've manually checked various things, rw access, access to sensitive folders/files etc.

  So far, I've only used it on two small projects. My major projects I've been clicking through prompts and recently switched to "auto" mode.

  I'm not quite sure why anyone would trust "--dangerously-skip-permissions". I've seen these agents go off-piste far too many times, installing unnecessary packages, environments, calling sudo & creating files in all sorts of places.

  There's a page on various sandboxing strategies on their site:

  https://code.claude.com/docs/en/sandbox-environments

  I've seen various comments in several topics with folk baking their own sandboxes. That's great. Although I'd be inclined to try Anthropic's solutions initially.

  by bsdz
• Worth mentioning as I think at least a few of the commenters are mixing them up: auto mode is different from --dangerously-skip-permissions / YOLO mode. In auto mode, there's a classifier that runs before any command is executed and theoretically blocks any dangerous commands from running. I've found it to be quite annoying and overly zealous, but probably pretty effective.
  by sandcat_
• "We spent the last several months testing whether auto mode is as safe or safer than an average user clicking through prompts."

  Yeah, might make sense from their perspective, but no thank you. I also do click through at times without reading everything, but I like to stay in control, learn about the new code and change direction if it goes off track. This would just burn more tokens because I have to throw away much and I hope my manual approval settings will be respected also with future updates (or I jump ship).

  by lukan
• This reminds me of a business lore I once heard about entrepreneurship. It goes on to tell how in a toothpaste company they needed to increase sales, then someone had an ingenious idea of making the hole on the tube larger so that when folks squeezed it more would come out increasing their consumption and therefore sales. It worked.

  I'll let you draw the analogy.

  by hmokiguess
• Besides the debate about whether this is "safer" than manual human review, I have a slightly different problem.

  Very often, when I'm running Claude in manual review mode, it will attempt to do things which are not "dangerous" but are misaligned with what I want it to do. Maybe I'm fighting the model here but for example, when orchestrating other agents to do work, Claude really badly wants to be overly prescriptive about how the work gets done, telling them exactly which files to edit, exactly what not to do, etc. instead of trusting the guardrails, review agents, or humans in the process to catch code-level mistakes. And no, telling it not to do this does not stick. Manual review is the last line of defense I have here.

  I have stuff I don't want blacklisted, only allow it to use tools with limited ability to boss around agents, and various hooks to try and catch behavior that the permissioning system can't. If I use Auto mode though, I lose this control. The classifier will gleefully approve these types of commands because guess what, it's also Claude.

  by dgunay
• I'm apparently from the very small faction of users who's been running `--dangerously-skip-permissions` in every instance of Claude for the last year. It's almost a reflex to me. For the most part Claude behaves well, but I don't blindly trust it. LLMs are inherently dangerous tools, and reviewing individual commands (or spamming `y`) doesn't make them less so. Safety is the responsibility of the developer putting sane guardrails (like VCS, immutable filesystems, or read-only tokens). Using more Claude to categorize the safety of Claude commands is not the answer.
  by awkii