Based on Anthropic’s official docs, checked October 23, 2026

Claude Code auto mode: what runs, what gets blocked, how to turn it off

Auto mode is a Claude Code permission mode where a second model, the classifier, reviews actions instead of you. With Claude Code v2.1.283 or later it is the built-in starting mode for interactive terminal and VS Code sessions, and on Oct 22, 2026 Anthropic said Claude web, desktop and mobile sessions on Pro, Max and Team will start in auto mode by default from next week. This page sums up what Anthropic's permission-modes docs say runs, what gets blocked and how to turn it off. Everything here comes from those docs; we have not benchmarked the classifier.

1. 1. Check which mode you are in

   In the terminal the status bar shows the active mode: ⏵⏵ auto mode on in auto mode, and ⏸ manual mode on in Manual mode (config value default). The first time the built-in default starts a session in auto mode, Claude Code shows a notice that links to the docs.

2. 2. Switch back to Manual for one session

   Press Shift+Tab. From auto, the first press switches to default (Manual); the cycle then runs default, acceptEdits, plan. Or start the session with a flag.

   claude --permission-mode default

3. 3. Make Manual your default on this machine

   Set permissions.defaultMode in ~/.claude/settings.json. The CLI also accepts manual as an alias for default.

   {
     "permissions": {
       "defaultMode": "default"
     }
   }

4. 4. Turn auto mode off for an organization

   Admins set permissions.disableAutoMode to "disable" in managed settings. That removes auto from the Shift+Tab cycle, and a session started with --permission-mode auto starts in Manual instead.

   {
     "permissions": {
       "disableAutoMode": "disable"
     }
   }

5. 5. Keep auto mode but add a human checkpoint

   Ask rules still force a prompt in auto mode, so you can keep auto mode and require approval for pushes. Deny rules block in every mode.

   {
     "permissions": {
       "ask": ["Bash(git push *)"],
       "deny": ["Bash(rm -rf *)"]
     }
   }

What runs without asking

Per the docs, actions go through a fixed order: your allow, ask and deny rules resolve first; read-only actions and file edits in your working directory are auto-approved (protected paths excepted); everything else goes to the classifier.

Allowed by default include local file operations in your working directory, installing dependencies declared in your lock files or manifests, read-only HTTP requests, and pushing to a branch of the repository you are working in (deploy-style branches such as production or gh-pages are judged separately).

On entering auto mode, broad allow rules that grant arbitrary code execution are dropped, such as Bash(*), wildcarded interpreters like Bash(python*) and package-manager run commands. Narrow rules like Bash(npm test) stay, and the dropped rules come back when you leave auto mode.

What the classifier blocks by default

The documented block list includes downloading and executing code such as curl | bash, sending sensitive data to external endpoints, production deploys and migrations, mass deletion on cloud storage, granting IAM or repo permissions, force push, git reset --hard and other commands that discard uncommitted work, terraform or pulumi destroy, writing to a secret manager or changing DNS, merging a pull request no human approved, opening a public tunnel, and printing a live credential into the transcript.

Run claude auto-mode defaults to print the full allow and block lists as JSON for your version.

Writes to protected paths such as .git, .claude, .vscode, .mcp.json and shell rc files are never auto-approved; in auto mode they go to the classifier.

What happens when something is blocked

A blocked action shows a notification and appears in /permissions under Recently denied, where you can press r to retry with manual approval.

If the classifier blocks 3 actions in a row or 20 in total, auto mode pauses and Claude Code goes back to prompting. These thresholds are not configurable.

Boundaries you state in chat, such as "don't push", act as block signals, but they are re-read from the transcript and can be lost after compaction. For a hard guarantee, add a deny rule.

Where auto mode is not the default

claude -p and Agent SDK runs start in Manual (default) in v2.1.302 or later; pass --permission-mode auto to opt in.

Organizations with the HIPAA configuration start sessions in Manual, with auto mode still available to switch to.

Setting "auto" in a project .claude/settings.json or settings.local.json does not take effect; put it in ~/.claude/settings.json instead.

Auto mode needs a supported model: on the Anthropic API, Claude Opus 4.6 or later, Sonnet 4.6 or later, Haiku 5.5 or a Fable model. Older models such as Sonnet 4.5 are not supported.

Cost and latency

On Enterprise plans and API, Bedrock, Agent Platform and Foundry accounts, classifier calls count toward your token usage, and each check adds a round trip before the action runs. Reads and working-directory edits skip the classifier, so the overhead comes mostly from shell and network actions. Where the server reviews actions as part of the model request, there are no separate classifier calls.

Tips

• Anthropic warns that auto mode reduces prompts but does not guarantee safety; keep Manual for sensitive operations.
• Use plan mode first on unfamiliar repos so you can read the plan before anything runs.
• If routine actions keep getting blocked, an admin can list trusted repos, buckets and services in autoMode.environment.
• Pair auto mode with the Bash sandbox or a container for defense in depth.

Next steps

Sources

• https://code.claude.com/docs/en/permission-modes · checked 2026-10-23
• https://x.com/claudeai/status/2113360845409583307 · checked 2026-10-23