Auto Mode is a 📝Claude Code permission system that uses AI classifiers to approve safe actions automatically and block dangerous ones, sitting between manual approval of every step and fully unrestricted operation.
Announced by 📝Anthropic in March 2026, Auto Mode targets "approval fatigue" — the tendency to stop scrutinizing permission prompts after approving hundreds of them. Anthropic reports that users approve roughly 93% of prompts, which erodes the safety value of manual review. Auto Mode replaces routine approvals with automated classification while preserving a guardrail against genuinely risky actions.
It operates through two defensive layers. An input layer screens tool outputs for prompt-injection attempts before they reach the agent; an output layer runs a transcript classifier that evaluates each proposed action against safety criteria before execution, using a fast filter followed by deeper reasoning on flagged cases. The classifier deliberately sees only user messages and tool commands — assistant reasoning and tool outputs are stripped out, so a compromised session cannot talk its way past the check.
On overeager actions the classifier catches roughly 83% of dangerous behaviors at a 0.4% false-positive rate, and it ships with more than 20 default block rules spanning destruction, credential exposure, and cross-boundary actions, all tunable with environment definitions and carve-outs. Auto Mode complements 📝Permissions (Claude Code): where permissions are static allow / ask / deny rules, Auto Mode is a dynamic classifier layered on top.