Anthropic gives Claude Code an Auto Mode to cut permission spam

Coding with AI agents usually forces a painful choice: babysit every bash command, or flip the dangerous switch and pray it doesn't drop your production database.

Anthropic wants to end that dilemma.

Anthropic rolled out a research preview of "Auto Mode" for Claude Code, initially available to Team plan users and coming to Enterprise and API customers in the coming days. The feature works with both Claude Sonnet 4.6 and Opus 4.6.

A safety guardrail for vibe coding

Up until now, Claude Code's default permissions asked for human confirmation before writing files or running shell commands. Impatient developers often bypassed this using the `--dangerously-skip-permissions` flag, which removed friction but invited catastrophic failures.

Auto Mode creates a sensible middle ground. Instead of nagging you for every action, an AI classifier inspects each tool call right before it executes.

If the action is deemed safe, it runs automatically. If it looks dangerous—like mass deleting files, exfiltrating sensitive data, executing malicious code, or falling for prompt injection attacks—the guardrail blocks it and tells Claude to try a different path. Claude only pings you if it keeps getting stuck.

Admins can disable it across organizations, while developers can turn it on in the CLI via `claude --enable-auto-mode` or toggle it in VS Code and desktop settings. Keep in mind: Anthropic notes that Auto Mode incurs a slight hit on token usage, costs, and tool-call latency.

Why it matters

We think Auto Mode is a massive quality-of-life upgrade for developers who want to kick off longer agentic coding tasks without babysitting them.

Instead of trusting the primary model to behave itself, Anthropic's approach puts a dedicated security guard in front of the terminal. It's a clever implementation of "AI monitoring AI" that bridges the gap between paranoid security defaults and chaotic autonomy.

That said, Anthropic hasn't disclosed the exact criteria its safety classifier uses to judge risk, and the company admits it can still misinterpret ambiguous prompts or block benign actions. It makes agentic coding substantially safer, but as Anthropic itself warns, you should still keep these autonomous runs confined to sandboxed environments.