What Is Auto Mode in Claude Code and How Do You Use It?

What Is Auto Mode in Claude Code and How Do You Use It?

The first hour with Claude Code is fine. The second hour is a permission prompt every ninety seconds, and by the third you are hitting Enter without reading them.

That is the real problem auto mode solves. Not speed — attention. A prompt you approve reflexively is not a safety control, it is a habit.

Auto mode replaces most of those prompts with a check that actually reads what is about to run. It is not the same thing as turning permissions off, and the difference is worth understanding before you switch it on.

The Short Answer

Auto mode is a Claude Code permission mode in which a separate classifier model reviews actions before they run, instead of stopping to ask you.

Anthropic's own documentation describes it as a mode that "runs without routine prompts; before actions such as shell commands and network requests run, a background classifier checks that they align with your request."

Press Shift+Tab to cycle to it. That is the whole setup on most machines.

It is available on all plans, and on recent versions of Claude Code it is the mode interactive sessions start in by default.

Your docs ship fast. Does your site rank? A free SEO audit shows which of your pages search engines and AI assistants actually surface. Get a free audit.

What Auto Mode Actually Does

The mental model most people start with is wrong. Auto mode is not "approve everything automatically."

It is a triage system with three outcomes, and understanding the order they apply in explains almost every behaviour you will see.

The Decision Order

Claude Code resolves each tool call against a fixed sequence.

Your own allow, ask and deny rules resolve first. If you wrote a deny rule, nothing downstream can override it.

Read-only actions and file edits inside your working directory are then auto-approved, with two carve-outs: writes to protected paths, and the first read outside your working directories.

Everything else goes to the classifier. Shell commands, network requests, anything that touches the world outside the project.

If the classifier blocks something, Claude is told why and redirects to a different approach rather than simply failing.

What the Classifier Can See

This part matters for security and is widely misunderstood.

The classifier sees your messages, the tool calls themselves, and your CLAUDE.md content. It does not see tool results.

That omission is deliberate. Tool results are stripped so that, in Anthropic's words, "hostile content in a file or web page can't manipulate the classifier directly."

The practical consequence: a prompt-injection string buried in a README cannot talk the classifier into approving a command, because the classifier never reads the README.

What It Blocks by Default

The documented default blocks are the ones you would hope for.

• Downloading and executing code in one step, such as curl | bash
• Force pushes
• Production deploys and migrations

Those are the categories where a plausible-looking command does irreversible damage, which is exactly where a reflexive Enter press costs you.

How Do You Turn It On?

There are several routes and they are not equivalent, so pick the one that matches how you work.

1. In the terminal. Press Shift+Tab to cycle permission modes. Auto appears in the cycle when it is available to your session.
2. From a flag. Run claude --permission-mode auto. The same flag works with -p for non-interactive runs.
3. From a permission prompt. Bash prompts offer a third option, "Yes, and switch to auto mode," which approves the command and switches at the same time. This needs v2.1.247 or later.
4. As your default. Set "permissions.defaultMode": "auto" in ~/.claude/settings.json. Note the scope carefully — the docs state that "auto" set in .claude/settings.json or .claude/settings.local.json "doesn't take effect."
5. In VS Code. Pick Auto from the mode indicator. The claudeCode.initialPermissionMode setting does not accept auto, so the indicator is the route.
6. On desktop and web. Use the mode selector in the session.

That settings-scope gotcha in step four is the one that wastes an afternoon. Project-level settings files will not set auto mode as the default; user-level settings will.

Which Mode You Start In

On Claude Code v2.1.283 or later, auto is the built-in starting mode for interactive terminal and VS Code sessions on every plan and provider.

Earlier versions start in auto only on Pro, Max and Team plans.

Three session types always start in Manual instead: claude -p, the Agent SDK, and HIPAA-configured sessions. If you are scripting Claude Code, you are in Manual unless you say otherwise.

Model Requirements

Auto mode needs a recent model, and the requirement differs by provider.

On the Anthropic API and Claude Platform on AWS, it needs Claude Opus 4.6 or later, Sonnet 4.6 or later, Haiku 5.5, or a Fable model.

On Bedrock, Agent Platform, Foundry and a signed-in Claude apps gateway, the bar is higher: Sonnet 5 or later, Opus 4.7 or later, Haiku 5.5, and the Fable models.

Older models are not supported on any provider. If auto is missing from your Shift+Tab cycle, check the model before you check anything else.

Before you ship, check what search sees. One free audit, one prioritised list of fixes for your site. Start the audit.

What Still Prompts You

Auto mode is not a blanket. Several categories reach you regardless of the mode you are in.

Protected paths are a small set of files where writes are never auto-approved outside bypassPermissions. The list includes .git, .vscode, .idea, .claude, .gitconfig, .bashrc, .zshrc, .npmrc, .mcp.json and .claude.json.

In auto mode those writes route to the classifier rather than being approved outright — and crucially, allow rules in your settings files do not pre-approve them.

Actions no mode auto-approves reach you even in bypassPermissions. That set includes anything matched by an explicit ask rule, AskUserQuestion, MCP tools marked requiresUserInteraction, and recognised rm or rmdir removals on critical paths.

Your Broad Allow Rules Get Dropped

This one surprises people who have carefully built up a permissions file.

Entering auto mode drops broad allow rules. A blanket Bash(*) or PowerShell(*) stops applying, and Agent allow rules do too.

Narrow rules survive. Bash(npm test) keeps working exactly as before.

The logic is sound: a blanket allow rule and a classifier are two different safety models, and letting the first one override the second would make the second pointless.

Limitations and Risks Worth Knowing

Anthropic is unusually direct about what auto mode does not give you, and the warning is worth quoting rather than paraphrasing.

"Auto mode reduces permission prompts but does not guarantee safety. Use it for tasks where you trust the general direction, not as a replacement for review on sensitive operations."

Several specific limits sit underneath that.

The trust boundary is fixed at session start. The classifier trusts your working directory and the remotes configured for it when the session began. A remote added mid-session is not trusted.

Repeated blocks pause the mode. After three blocks in a row, or twenty in total, auto mode pauses and Claude Code goes back to prompting. Those thresholds are not configurable.

Boundaries are not durable. Instructions you give in conversation are not stored as rules, and the docs note that "a boundary can be lost if context compaction removes the message that stated it." If a constraint matters, put it in a deny rule, not in a sentence.

It costs tokens and latency. On Enterprise and API accounts, classifier calls count toward your token usage and add a round trip before execution.

It can be switched off above you. Auto mode can be turned off server-side, and a session that receives that answer keeps it off until the session ends.

The Administrator Switch

Organisations can disable it outright. Setting permissions.disableAutoMode to "disable" in any settings file prevents auto mode from being used, and it is most useful in managed settings where a developer cannot override it.

On Team and Enterprise plans auto mode is on by default unless an administrator sets that key.

Shipping faster than your site ranks? A free audit shows the gap between what you build and what search surfaces. Request yours.

Auto Mode vs the Other Permission Modes

Claude Code has six permission modes, and auto sits deliberately in the middle of the range.

Manual (default) prompts on first use of each tool. Maximum control, maximum interruption. Correct when you are working in an unfamiliar repository or near production.

acceptEdits auto-approves file edits and common filesystem commands such as mkdir, touch, mv and cp within your working directories. It handles the most frequent prompts without touching shell or network behaviour.

Plan keeps Claude reading and exploring without editing your source files. With auto mode available, classifier-approved commands also run during planning.

Auto is the middle path: no routine prompts, with a classifier standing between Claude and anything consequential.

dontAsk auto-denies anything that would otherwise prompt. Useful for locked-down automation where you would rather a task fail than escalate.

bypassPermissions skips prompts entirely, including writes to protected paths. Anthropic's guidance is unambiguous — use it "only in isolated environments like containers or VMs where Claude Code can't cause damage."

Developers find your tool. Does search? A free audit shows which pages rank and which never get crawled. Get a free audit.

Which One Should You Actually Use

For day-to-day work in a repository you know, auto mode is the right default, and on recent versions it is already the default.

For anything touching production, drop to Manual deliberately. The classifier is good; it is not accountable.

For CI and scripted runs, you are in Manual whether you meant to be or not, so set the mode explicitly rather than discovering it.

And if you find yourself reaching for bypassPermissions on your own machine, the honest answer is usually that a deny rule would solve the actual problem better.

Final Thoughts

Auto mode is the first permissions design in an agentic coding tool that takes the approval-fatigue problem seriously rather than treating it as the user's discipline problem.

The thing to internalise is the boundary. The classifier reads intent against your request; it does not read the contents of the files it is operating on, and it does not know what your deploy script does to customers.

Set deny rules for the handful of things that must never happen. Let auto mode handle the hundred things a day that are fine. Drop to Manual when the blast radius grows.

If you are still setting up the tool itself, our walkthrough of the Claude Code CLI covers installation, updates and where the terminal is the right surface in the first place.

The prompt you stopped reading was never protecting you. A check that reads the command is a real improvement — as long as you remember it is a check, not a guarantee.