how does claude code auto mode work?

auto mode is a claude code permission mode where a separate classifier model reviews actions not allowed by permission rules*

anthropic positions it as a middle ground between default prompting and --dangerously-skip-permissions (which allows everything — useful for isolated envs like containers)
in auto mode, the classifier rejects anything risky — irreversible, destructive, or aimed outside your environment
the environment is defined as the working directory plus the repo’s configured remotes by default
when a risky action is blocked, claude looks for a safer approach
3 blocks in a row or 20 blocks in a session pause auto mode; approving the prompt resumes auto mode
environment can be defined via autoMode.environment in global settings.json

* → reads and edits inside the current working directory are auto-approved (except for some protected paths)

does the classifier step add latency?

yes, compared to --dangerously-skip-permissions
however, most actions within a typical session are reads and edits within the current working directory, which are default allowed
additionally, the classifier model works in 2 stages
stage 1 is a fast single-token yes/no filter while stage 2 runs only on the stage 1 flagged actions

stage 1 was found to have 8.5% false positives, which reduces to 0.4% when combined with stage 2
however, having stage 2 was also found to increase misses from 6.6% to 17%
false positives: classifier blocks a safe action; the cost is annoyance
misses: classifier allows a risky action; the cost is integrity failure