Claude Code auto mode: what it allows, what still asks, and how to switch it

Claude Code auto mode runs tool calls without asking you: a second model, the classifier, checks each action that is not a read or an edit in your working directory, and blocks what goes beyond your request. Press Shift+Tab to switch in or out of it; from Claude Code v2.1.283 an interactive session starts in it unless you set another mode.

What auto mode is

Anthropic introduced auto mode on 24 March 2026 as a research preview on the Team plan, as "a safer long-running alternative to --dangerously-skip-permissions". It needed --enable-auto-mode until Claude Code 2.1.111 (16 April 2026), became generally available for all users on 10 July 2026, and is now the mode an interactive session starts in. On Pro, Max and Team plans this began with 2.1.228 (11 August 2026; 2.1.233 on native Windows); for third-party providers and telemetry off with 2.1.283 (25 September), and for every plan and provider with 2.1.284 (28 September). The permission-modes page names v2.1.283 for the last two.

From Anthropic's permission-modes page, read 21 October 2026:

• What runs without a prompt: reads, and file edits in your working directory, skip the classifier. Everything else — shell commands, network calls, edits elsewhere — goes to it first.
• What the classifier sees: your messages, Claude's tool calls and your CLAUDE.md. Tool results are stripped, so text in a file or web page cannot talk to it directly.
• What happens on a block: Claude gets the reason and tries another way. You see a notification, and /permissions lists the action under Recently denied, where r retries it with your approval.
• Subagents: the classifier checks a subagent's task before it starts, each of its actions, and its report; a permissionMode in its frontmatter is ignored. More in Claude Code subagents.
• Who can use it: all plans. On the Anthropic API it needs Opus 4.6 or later, Sonnet 4.6 or later, Haiku 5.5 or a Fable model; on Bedrock, Agent Platform and Foundry, Sonnet 5, Opus 4.7 or later, Haiku 5.5 or Fable. On an older model a session asked to start in auto starts in Manual.

How to turn auto mode on or off

From Anthropic's docs, read 21 October 2026:

• Switch during a session: Shift+Tab. From auto, the cycle runs Manual → accept edits → plan → auto.
• Start one session in it: claude --permission-mode auto.
• Make it your default: "permissions": {"defaultMode": "auto"} in ~/.claude/settings.json.
• Start in Manual instead: claude --permission-mode default (or manual), or "defaultMode": "default".
• Remove it: "permissions": {"disableAutoMode": "disable"}. In managed settings nobody can override it.
• VS Code: pick Auto from the mode indicator; the extension's claudeCode.initialPermissionMode setting does not accept auto.

defaultMode: "auto" in a project's .claude/settings.json or .claude/settings.local.json is ignored and the built-in default applies, so a cloned repository cannot put you in auto mode; bypassPermissions there starts the session in Manual.

From a Bash prompt in Manual or accept-edits mode, Yes, and switch to auto mode approves the command and switches the session; approving a plan offers Yes, and use auto mode. claude --continue and claude --resume <id> bring a session back in the mode it was in, with a few exceptions the sessions page lists.

Claude Code permission modes, side by side

What auto mode blocks, and what it allows

The classifier trusts your working directory and the git remotes the repository had when the session started. Everything else is external until you list it in autoMode.environment. Among the defaults it blocks:

• Running downloaded code, such as curl | bash.
• Sending sensitive data out, or printing a live credential into the transcript.
• Production deploys and migrations, terraform destroy and its kin, and changes to shared infrastructure, DNS or secrets.
• Destroying work: a force push, git reset --hard, git clean -fd, deleting files that existed before the session.
• Merging a pull request no human approved, or disabling CI checks.
• Starting an unattended agent loop, such as another agent run with --dangerously-skip-permissions.

It allows by default: local file work in the working directory, installing the dependencies your lock files declare, read-only HTTP requests, and pushing to any branch of the repository you are in, except one named as a deploy target, such as production or gh-pages. claude auto-mode defaults prints the full rule lists as JSON; claude auto-mode config prints what applies to you.

A boundary you state in the chat ("don't push until I review") blocks matching actions until you lift it, but compaction can drop the message that said it. For one that holds, write a rule:

{
  "permissions": {
    "ask": ["Bash(git push *)", "Bash(gh pr create *)"],
    "deny": ["Read(./.env)"]
  }
}

Deny rules block in every mode; content-scoped ask rules prompt even in auto mode.

Why Claude Code keeps asking for permission in auto mode

Auto mode removes routine prompts, not all of them. You still get one for:

• An ask rule you wrote, like the one above.
• The first read outside the working directories. Answer Yes, and keep allowing and it does not come back; No, and block reads outside the working directories from now on turns on the setting below.
• permissions.blockReadsOutsideWorkingDirectories. While it is on, a file-reading Bash command outside the project prompts in every mode, auto and bypass included, and so does a command the shell parser cannot trace. Add the folder with --add-dir or /add-dir, or remove the setting.
• Repeated blocks. After 3 blocks in a row or 20 in one session, auto mode pauses and Claude Code asks; approving resumes it. The limits are fixed.
• rm on a critical path such as ~ or the project root. In the terminal the prompt counts down two minutes, then denies the command.
• A question Claude asks you, and MCP tools marked as needing a person.

Writes to protected paths — .git, .claude, .vscode, shell profiles, .mcp.json — do not prompt in auto mode; they go to the classifier, and in bypass mode they are written.

What that setting does, measured on my machine: Caprock keeps every PermissionRequest hook, and the first one it recorded is from 5 October 2026. Up to 9 October, one session ran in auto mode, with blockReadsOutsideWorkingDirectories on; the rest ran with permissions skipped.

236

prompts in 2,037 tool calls: the auto-mode session, 6–7 October

47

prompts in 10,012 tool calls: four bypass sessions, 5–9 October

55

of the 236 offered to allow reads of a folder outside the project

The hook says which mode a prompt came from, not why it was asked, so the other 181 are not attributed. About one prompt per nine tool calls made auto mode look broken that day; Caprock's notes of 7 October trace the flood to the setting, not to the mode.

Auto mode vs bypass permissions

• Auto mode (--permission-mode auto): no routine prompts; a classifier reviews each risky action, writes to .git and .claude included. Use it on your own machine for long tasks you trust the direction of.
• Bypass (--dangerously-skip-permissions, the same as --permission-mode bypassPermissions): no classifier, protected paths written without asking; only deny and ask rules, critical-path rm and a few hard stops remain. Anthropic's docs say to run it only in containers or VMs. The details are in claude --dangerously-skip-permissions.
• dontAsk for CI: an exact list of allowed tools, everything else denied, no model judging.

In a -p run there is nobody to ask: in auto mode, an action blocked past the limits is skipped and the run goes on.

Answer the prompts that are left, from one place

Caprock is a free, open-source desktop app for macOS, Windows and Linux that records every Claude Code session on the machine through its hooks, whether or not it started it, and runs claude in terminal tabs. A session stopped on a permission prompt is listed near the top of the sidebar under Waiting on you, and for a session Caprock started, a card answers it.

⤢

⤢

• The card reads the menu before it types. When the classifier hands a command back ("This command requires approval"), the dialog is 1. Yes 2. No, where other menus put "don't ask again" at 2. Caprock picks the option by its text; when the one you pressed is not on the screen, it types nothing and says that option is not on the prompt — answer in the terminal.
• One prompt open: Yes and No. Subagents running in parallel can ask at once, and nothing tells Caprock which dialog the terminal shows. With two or more open, the card lists each with who asks ("Subagent (general-purpose) wants to run Bash") and offers Open terminal instead; the daemon refuses to type an answer.
• Away from the card: the menu bar and a notification with Approve and Deny on macOS and Linux (Approve only when it shows the whole request), a paired phone that can control sessions (the default when you pair it), and a Telegram message from your own bot for any session on the machine, whoever started it.
• The mode survives a continue. Continuing or branching a session from Caprock starts it in the mode its hooks last reported, auto included, and says which beside the button.

Starting a session: the New agent sheet offers Accept edits · asks first, Plan · changes nothing and Bypass · never asks, and passes them to claude as --permission-mode acceptEdits, --permission-mode plan and --dangerously-skip-permissions. Auto mode is not on that list; the tab runs the real claude, so press Shift+Tab in it.

What Caprock does not do

• It does not decide. It never approves on its own and does not change what the classifier blocks; auto mode's rules are Claude Code's.
• Buttons only for its own sessions. A session you started in another terminal shows as waiting, and gets the Telegram alert, but you answer it in that terminal: Caprock never types into a process it did not start.
• Claude Code only. Codex and OpenCode report no approval Caprock can read.

Which to use

• Auto mode — your own machine, long tasks, and a recent model. Add ask rules for pushes if you want to see them.
• Accept edits or Manual — sensitive work, or a repository you do not know.
• Bypass — a container or VM without your credentials in it.
• Caprock — several sessions at once, and the prompts that remain should reach you wherever you are. Install Caprock.