← Back to the summary

Claude Code Defaults to Auto Mode August 14 — Here Are the 6 Permission Locks to Set First

I saw Anthropic's announcement on Friday evening. The gist is: Starting August 14, Auto mode will be enabled by default for Claude Code Pro, Max, and Team users.

In plain terms — starting the day after tomorrow, Claude Code will no longer ask you one by one, "Can I execute this command?" Instead, it will assess safety on its own and execute directly. Modifying files, running scripts, performing git operations — all automatic.

My first reaction was to open the terminal and check my settings.json. Not because I thought Auto mode would definitely blow up, but because the default value for this thing has changed, meaning if you do nothing, the behavior changes.

Why Anthropic dares to do this

They provided three data points:

Data Point 1: 97% of permission prompts are approved without thinking.

Anthropic tallied permission operations across all Claude Code users — every time Claude popped up an "Allow?" confirmation box before executing a command, in 97% of cases, users directly clicked agree.

This means that confirmation box is practically useless. You think you are "reviewing," but in reality, you are reflexively hitting Enter.

Data Point 2: 62% of users are already using bypassPermissions or similar settings.

Over half of paying users have long since actively turned off permission confirmations. Among Claude Code's six permission modes, the strictest Manual mode is actually used by a minority.

Data Point 3: A controlled experiment with 1,053 people showed Auto mode is 6.5x safer than manual review.

Anthropic ran a controlled study — for the same sequence of dangerous commands, Auto mode's built-in classifier blocked 89%, while manual step-by-step review blocked only 13.6%.

The reason is simple: machines don't get tired, and they won't zone out and click agree on the 47th "Allow?". Humans will.

But — an 11% miss rate

The flip side of an 89% block rate is: 11% of dangerous commands were not blocked by Auto mode either.

What are these 11%? According to the public test report, they are mainly:

Commands that look like normal operations but have side effects (e.g., rm -rf wrapped inside a seemingly harmless script)
Indirect operations involving environment variables or sensitive paths
Chained dangerous operations in combined commands (each step looks safe individually, but becomes dangerous when strung together)

11% doesn't sound like much, but if you run 100 commands a day, on average, 11 dangerous operations will be let through daily.

What exactly Auto mode will "auto"-do

With Auto mode on, Claude Code will no longer ask you about the following operations:

Operation Type	Manual Mode	Auto Mode
Read files	Auto	Auto
Write/Modify files	⚠️ Requires confirmation	✅ Auto-execute
Execute Bash commands	⚠️ Requires confirmation	✅ Auto-execute (unless triggers danger classifier)
git add/commit	⚠️ Requires confirmation	✅ Auto-execute
git push	⚠️ Requires confirmation	🔴 Blocked by classifier (most cases)
rm/delete operations	⚠️ Requires confirmation	🟡 Depends on path and context
Install npm packages	⚠️ Requires confirmation	✅ Auto-execute
Modify package.json	⚠️ Requires confirmation	✅ Auto-execute

The key change: File writes and Bash command execution no longer require your confirmation. This means Claude can directly change your code, run scripts, and install packages — as long as its built-in classifier deems it "safe."

The 6 settings I changed

After reading the announcement, the first thing I did was not turn off Auto mode (that would just revert to the state of mindlessly clicking agree 97% of the time), but rather add constraints on top of Auto mode.

Setting 1: Configure an allowedTools whitelist

// .claude/settings.json
{
  "permissions": {
    "allow": [
      "Read",
      "Glob",
      "Grep",
      "Write(src/**)",
      "Edit(src/**)"
    ],
    "deny": [
      "Write(.env*)",
      "Write(*.config.js)",
      "Bash(rm *)",
      "Bash(git push*)"
    ]
  }
}

Core idea: Only allow Claude to auto-write files under the src/ directory. Configuration files, environment variables, and root directory files all require confirmation. This way, Claude can freely modify business code but cannot touch build configurations or sensitive files.

Setting 2: Lock down .env and sensitive files

{
  "permissions": {
    "deny": [
      "Read(.env*)",
      "Write(.env*)",
      "Read(**/*secret*)",
      "Read(**/*credential*)",
      "Bash(*SECRET*)",
      "Bash(*TOKEN*)",
      "Bash(*PASSWORD*)"
    ]
  }
}

In Auto mode, Claude can read any file in the project — including .env. If your .env contains database passwords or API keys, Claude might hardcode them into generated code after reading them, or accidentally expose them during command execution.

Deny rules have higher priority than allow rules. Once a deny rule is configured, even Auto mode will be blocked.

Setting 3: Git operation restrictions

{
  "permissions": {
    "deny": [
      "Bash(git push*)",
      "Bash(git reset --hard*)",
      "Bash(git checkout -- *)",
      "Bash(git clean*)",
      "Bash(git branch -D*)"
    ]
  }
}

In Auto mode, Claude can automatically git add and git commit — this is actually quite convenient. But irreversible operations like push, reset --hard, and force-deleting branches must be manually confirmed.

A real case: Last week, I saw someone post that Claude Code in Auto mode automatically pushed a commit with debug logs to the main branch. The reason was that Claude judged "commit+push is a complete workflow," and the classifier did not block the push operation.

Setting 4: npm install restrictions

{
  "permissions": {
    "deny": [
      "Bash(npm install *--global*)",
      "Bash(npx *)",
      "Bash(yarn global*)"
    ],
    "allow": [
      "Bash(npm install)",
      "Bash(npm run *)",
      "Bash(yarn install)",
      "Bash(yarn add *)"
    ]
  }
}

Allow Claude to install packages within the project (npm install, yarn add), but prohibit global installations and npx execution. npx can download and execute arbitrary packages — this is a massive attack surface.

Setting 5: Add hard rules to CLAUDE.md

# CLAUDE.md

## Security Rules (Must be followed in Auto mode)

- Never modify .env, .env.local, or any files containing environment variables
- Never execute git push; all push operations must be performed manually by me
- Never delete files; if deletion is needed, list the files first and wait for my confirmation
- Never modify CI/CD configuration files (.github/workflows/*, .gitlab-ci.yml)
- When adding new dependencies, state the reason; do not install silently

CLAUDE.md is Claude Code's behavioral rules file. In Auto mode, Claude will follow these rules — of course, this is not a "hard" restriction (the deny rules in settings.json are), but it provides a layer of semantic-level protection.

Setting 6: Enable operation logging

{
  "auditLog": {
    "enabled": true,
    "path": ".claude/audit.log",
    "includeCommands": true,
    "includeFileWrites": true
  }
}

The most dangerous thing in Auto mode is not what Claude executes, but that you don't know what it executed. With audit logging enabled, every file modification and command execution is recorded. Spending 2 minutes a day scanning the log is 100 times faster than troubleshooting after the fact.

Recommended configurations for different scenarios

Scenario	Recommended Mode	Key Settings
Personal side project	Auto + loose allow	Allow most operations, only deny push and rm
Company project (with CI)	Auto + strict deny	Lock down config/env/CI files, only allow src/
Multi-contributor repository	Plan mode	Let Claude propose a plan first before executing, to avoid conflicts
Production environment related	Manual	Don't use Auto; confirm step by step
Open source project maintenance	Auto + deny push	Prevent accidental pushes to public repositories

Why not just turn off Auto mode

Some might say: Since there are risks, why not just switch back to Manual?

Because Anthropic's data is correct — 97% of confirmation prompts, you mindlessly click through. Manual mode doesn't give you security; it gives you the "illusion of security." You think you are reviewing, but after the 10th time, you stop looking.

Auto mode + precise deny rules is actually safer than Manual mode:

Manual: Every operation asks you → You get fatigued and mindlessly approve everything → Dangerous operations are also approved
Auto+deny: Safe operations auto-execute → Your configured deny rules provide hard blocks → Truly dangerous operations must be manually confirmed

The difference: Manual mode's security depends on your attention (which fatigues), while Auto+deny's security depends on your configuration (which doesn't fatigue).

Pre-8/14 checklist

Auto mode is enabled by default the day after tomorrow. If you haven't configured it yet, at least do these things:

# 1. Check the current permission mode
cat .claude/settings.json

# 2. If the file doesn't exist, create one
mkdir -p .claude
touch .claude/settings.json

# 3. At least add this minimal security configuration
cat > .claude/settings.json << 'EOF'
{
  "permissions": {
    "deny": [
      "Write(.env*)",
      "Bash(git push*)",
      "Bash(git reset --hard*)",
      "Bash(rm -rf*)"
    ]
  }
}
EOF

# 4. Confirm CLAUDE.md exists and has security rules
cat CLAUDE.md

Auto mode security settings cheat sheet

Protection Target	Deny Rule	Priority
Environment variables/Secrets	`Write(.env)`, `Read(.env)`	🔴 Must
Irreversible git operations	`Bash(git push)`, `Bash(git reset --hard)`	🔴 Must
File deletion	`Bash(rm -rf)`, `Bash(rm -r )`	🔴 Must
CI/CD configuration	`Write(.github/**)`, `Write(.gitlab-ci.yml)`	🟡 Strongly recommended
Package manager config	`Write(package.json)`	🟡 Depends on situation
Global installations	`Bash(npm install --global)`, `Bash(npx *)`	🟡 Strongly recommended
Build configuration	`Write(webpack.config)`, `Write(vite.config)`	🟢 Optional

Core principle: Let AI automatically do safe things, hard-block dangerous things

Auto mode is not a monster. Anthropic's data proves an awkward fact: Most people's "manual review" is actually less reliable than an AI classifier.

But the 11% miss rate is also real. Starting the day after tomorrow, if you configure nothing, Claude Code will use its own judgment to decide which operations are safe — and its judgment has an 11% chance of being wrong.

So the correct strategy is not a binary choice (all manual vs. all auto), but rather: Let Auto handle the 97% of safe operations, and use deny rules to hard-block the 3% of things you absolutely will not allow to be executed automatically.

Is your Claude Code configured? August 14th is the day after tomorrow.