Anthropic introduces auto mode for Claude Code, a new mode that automatically determines which actions are permitted. A classifier checks each action for potentially dangerous behavior before execution.
Anyone who wants to perform longer tasks with Claude Code quickly runs into a problem. By default, the tool asks for confirmation with every file change or bash command. This is useful for oversight, but impractical if you want to start a complex task and step away for a moment.
Anthropic offers a middle ground with auto mode. With this, Claude Code makes permission decisions independently, without the user needing to be present at every step. This differs from the existing --dangerously-skip-permissions option, which skips all checks and thus entails significant risks. Auto mode is an explicit middle ground.
At the heart of auto mode is a classifier that runs before every tool call. It assesses whether an action is potentially dangerous. Examples include mass-deleting files, leaking sensitive data, or executing malicious code. Actions deemed safe are executed automatically. Risky actions are blocked, after which Claude seeks an alternative approach.
If Claude continues to insist on blocked actions, the tool will still prompt the user for permission. Anthropic emphasizes that auto mode reduces the risk compared to --dangerously-skip-permissions, but does not eliminate it. The recommendation remains to use the feature in isolated environments. If user intent is unclear or environmental context is limited, the classifier may still allow risky actions to proceed or, conversely, block harmless actions.
Auto mode is now available as a research preview for Claude Code Team subscribers. The rollout to Enterprise customers and API users will follow within a few days.