Anthropic introduced Claude Code auto mode, a safety system that automates permission decisions to reduce approval fatigue while maintaining security. The system uses a two-stage classification pipeline: Stage 1 performs rapid single-token filtering tuned conservatively to catch dangerous commands, while Stage 2 applies chain-of-thought reasoning only to flagged actions. By deliberately limiting the classifier’s view to user messages and tool-call payloads only, the design prevents agents from convincing the classifier to approve unsafe actions, achieving a 0.4% false positive rate while catching 83% of genuinely dangerous actions.
