跪拜 Guibai
← All articles
Frontend · AI Coding · Claude

Claude Code Defaults to Auto Mode August 14 — Here Are the 6 Permission Locks to Set First

By kyriewen ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

A default change that silently removes confirmation prompts means every Claude Code user who does nothing wakes up to an agent that can write files, run shell commands, and commit code unsupervised. The 11% classifier miss rate is not theoretical — it translates to roughly 11 uncaught dangerous operations per 100 commands, and the only defense is a deny-rule config that does not depend on human attention.

Summary

Anthropic's own data shows 97% of permission prompts get mindlessly approved and Auto mode's classifier blocks 89% of dangerous commands, versus 13.6% for fatigued humans. But an 11% miss rate means roughly one in ten risky operations still slips through. The change takes effect for all Pro, Max, and Team users on August 14.

The practical fix is not reverting to Manual mode, which creates an illusion of safety through prompts nobody reads. A deny-rule configuration that locks environment files, irreversible git operations, global package installs, and CI/CD configs provides a hard backstop that does not fatigue. Allowed operations run automatically; truly dangerous ones still require manual confirmation.

Six specific settings cover the critical surface area: a src/-only write whitelist, .env and credential read/write blocks, git push and destructive reset denials, npx and global install prohibitions, semantic rules in CLAUDE.md, and an audit log to surface what Auto mode actually did.

Takeaways
Auto mode becomes the default for Claude Code Pro, Max, and Team users on August 14, 2025.
97% of manual permission prompts are approved without review, making the confirmation dialog effectively useless.
Anthropic's controlled study found Auto mode's classifier blocks 89% of dangerous commands, while manual review blocks only 13.6%.
11% of dangerous commands still bypass the classifier, including disguised rm -rf calls, indirect env-var operations, and chained commands.
Auto mode auto-executes file writes, bash commands, git add/commit, and npm installs unless a deny rule intervenes.
Deny rules have higher priority than allow rules and provide a hard block that does not degrade with fatigue.
A minimal safe config denies writes to .env files, git push, git reset --hard, and rm -rf.
Restricting writes to src/** while denying config files, CI/CD definitions, and global installs limits the blast radius.
CLAUDE.md semantic rules add a second layer but are not a hard enforcement mechanism.
Enabling the audit log surfaces every file write and command execution for daily review.
Conclusions

Anthropic's decision to ship Auto as the default is backed by data showing the old confirmation model was security theater — 97% approval rates mean the prompts trained users to ignore them.

The 6.5x safety improvement claim is real but narrow: it measures classifier-versus-human on a specific test set, not real-world attack surfaces where an adversary crafts prompts to evade the classifier.

An 11% miss rate on dangerous commands is high enough that a deny-rule config is not optional — it is the difference between an agent that occasionally breaks things and one that is contained.

The shift from attention-based security (Manual mode) to configuration-based security (deny rules) mirrors the broader industry move from runtime prompts to policy-as-code in AI agent tooling.

Claude Code's permission model now resembles a firewall: default-allow with explicit deny rules, which puts the burden on the user to know what to block before something goes wrong.

Concepts & terms
Claude Code Auto mode
A permission mode where Claude Code assesses command safety using a built-in classifier and executes file writes, bash commands, and git operations without prompting the user for confirmation, unless a configured deny rule blocks the action.
Permission deny rules
JSON configuration entries in .claude/settings.json that hard-block specific operations (e.g., Bash(git push*), Write(.env*)) regardless of the active permission mode. Deny rules take priority over allow rules and are not subject to classifier override.
CLAUDE.md
A project-level markdown file that defines behavioral rules and context for Claude Code. In Auto mode, Claude reads and attempts to follow these semantic instructions, but they are not a hard enforcement mechanism like settings.json deny rules.
Dangerous command classifier
Anthropic's built-in model that evaluates whether a shell command or file operation is risky before Auto mode executes it. It blocked 89% of dangerous commands in testing but missed 11%, particularly chained or disguised operations.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗