What auto mode is
Auto mode in brief
Auto mode is one of Claude Code's permission modes. For the basics, see the Claude guide.
A classifier model reviews in place of a person
In auto mode, actions run without a permission prompt each time. Instead, a separate AI called a classifier model reviews them beforehand and blocks anything that escalates beyond your request, targets unrecognized infrastructure, or looks driven by hostile content Claude read.
"Auto mode lets Claude execute without routine permission prompts. A separate classifier model reviews actions before they run, blocking anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read. Explicit ask rules still force a prompt."(Eliminate permission prompts with auto mode section) — from the Claude Code official documentation
The starting mode on Pro, Max, and Team
On Pro, Max, and Team plans, auto mode is the built-in starting mode. That applies to terminal and VS Code extension sessions; claude -p, SDK usage, and the first session right after install start in Manual. It also requires v2.1.228 or later (v2.1.233 on Windows).
"On Pro, Max, and Team plans, auto mode is the built-in starting mode."(Eliminate permission prompts with auto mode section)／"The built-in `auto` default requires Claude Code v2.1.228 or later on macOS, Linux, and WSL, and v2.1.233 or later on native Windows. On earlier versions, the built-in default is Manual."(Which mode a session starts in section) — from the Claude Code official documentation
What actually stops
Blocked by default (selected)
curl | bashThe documentation enumerates the line.
Representative blocks
The classifier trusts your working directory and the remotes configured for it when the session started, treating everything else as external. Blocked by default: downloading and executing code, sending sensitive data to external endpoints, production deploys and migrations (applying database structure changes), mass deletion on cloud storage, granting IAM (cloud permission management) or repository permissions, modifying shared infrastructure, irreversibly destroying pre-existing files, force push (overwriting history), git reset --hard, and terraform destroy.
"The classifier trusts your working directory and the remotes that were configured for it when the session started."(What the classifier blocks by default section)／"Downloading and executing code, like `curl | bash`"／"Sending sensitive data to external endpoints"／"Production deploys and migrations"／"Mass deletion on cloud storage"／"Granting IAM or repo permissions"／"Modifying shared infrastructure"／"Irreversibly destroying files that existed before the session"／"Force push"／"`git reset --hard`, `git checkout -- .`, `git restore .`, `git clean -fd`, `git stash drop`, or `git stash clear`, which the classifier presumes would discard uncommitted changes"／"`terraform destroy`, `pulumi destroy`, `cdk destroy`, or `terragrunt destroy`, and applying a plan that destroys resources"(all from the Blocked by default list in the same section) — from the Claude Code official documentation
It does not make things safe
The documentation states plainly that auto mode reduces permission prompts but does not guarantee safety. It is positioned for work whose general direction you trust, not as a substitute for reviewing sensitive operations.
"Auto mode reduces permission prompts but does not guarantee safety. Use it for tasks where you trust the general direction, not as a replacement for review on sensitive operations."(warning box in the Eliminate permission prompts with auto mode section) — from the Claude Code official documentation
Switching and disabling it
How to change it
permissions.defaultMode in ~/.claude/settings.jsonpermissions.disableAutoMode to disable in managed settingsNone of this is fixed in place.
Switching in your own environment
The CLI cycles modes with Shift+Tab, and VS Code, Desktop, and claude.ai use the mode selector. To change the starting mode, use permissions.defaultMode — but since v2.1.142, auto does not take effect from a repository's .claude/settings.json or .claude/settings.local.json, so put it in ~/.claude/settings.json.
"Cycle modes with Shift+Tab in the CLI or use the mode selector in VS Code, Desktop, and claude.ai."(page introduction)／"In Claude Code v2.1.142 and later, `auto` doesn't take effect from those files. Move it to `~/.claude/settings.json`."(Eliminate permission prompts with auto mode section) — from the Claude Code official documentation
Turning it off for an organization
To stop developers in an organization from using auto mode, set permissions.disableAutoMode to disable in managed settings. That removes auto from the Shift+Tab cycle, and a session started with --permission-mode auto starts in Manual instead.
"Organization: on Team and Enterprise, auto mode is available by default. Administrators can turn it off for the organization by setting `permissions.disableAutoMode` to `"disable"` in managed settings."(Requirements block)／"To prevent developers from using auto mode, set `disableAutoMode` to `"disable"` in managed settings. This removes `auto` from the `Shift+Tab` cycle, and a session started with `--permission-mode auto` starts in Manual instead."(Auto mode on Bedrock, Agent Platform, or Foundry section) — from the Claude Code official documentation
When you want to read the documentation on your own machine as markdown with its headings and tables intact, the following tool can help.
