What
A new permission mode that uses an AI-powered "dangerous action classifier" to automatically approve safe tool actions and block dangerous ones, enabling fully autonomous long-running workflows without manual permission prompts.
Usage
claude --permission-mode auto
claude --enable-auto-modeDetails
- When enabled, each tool action is evaluated by a multi-stage security classifier before execution
- Safe actions (read-only tools, tools on an allowlist, or actions that would be allowed in
acceptEditsmode) are fast-pathed without classifier overhead - The classifier evaluates against a comprehensive threat model including prompt injection, scope creep, accidental damage, data exfiltration, and credential leakage
- Users see an opt-in dialog on first use with options: "Yes, enable auto mode", "Yes, and make it my default mode", or "No, go back"
- If the classifier repeatedly blocks actions (3 consecutive or 20 total), auto mode pauses and falls back to standard permission prompts
- In headless/SDK mode, too many denials or classifier unavailability causes the agent to abort
- Can be disabled per-settings via
permissions.disableAutoMode: "disable" - The classifier can be circuit-breaked server-side via
tengu_auto_mode_config
Evidence
Auto mode permission handler (search for "Auto mode classifier blocked action") — tM at line ~534821. Classifier prompt at g4q (search for "You are a security monitor for autonomous AI coding agents")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Feature flag
tengu_auto_mode_config Not enough to sayNothing here resolved what this flag was doing on this version, so nothing here should be read as on or off.
This account: no value returned · anonymous baseline: no value returned · compiled default in v2.1.71: no gate table built for this version
These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.
Read once, for one account on one subscription tier, against v2.1.71. It isn't a statement about your account. What a flag value here can and cannot tell you
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"modelByMainModel":{"claude-haiku-5-5":"claude-sonnet-5[1m]","claude-haiku-5-5[1m]":"claude-sonnet-5[1m]"},"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"modelByMainModel":{"claude-haiku-5-5":"claude-sonnet-5[1m]","claude-haiku-5-5[1m]":"claude-sonnet-5[1m]"},"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"modelByMainModel":{"claude-haiku-5-5":"claude-sonnet-5[1m]","claude-haiku-5-5[1m]":"claude-sonnet-5[1m]"},"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
Flag reading moved
The flag server now returns {"editRemovalCap":3000,"editRemovalVisibility":true,"enabled":"enabled","envOnboarding":true,"gitStatusType":true,"gitStatusUploads":false,"jsonlTranscript":true,"modelByMainModel":{"claude-haiku-5-5":"claude-sonnet-5[1m]","claude-haiku-5-5[1m]":"claude-sonnet-5[1m]"},"outcomeVisibility":false,"repoVisibility":true,"sameTurnSiblingContext":true,"severityByModel":{"claude-opus-4-8":{"t1":45,"t2":35},"claude-opus-4-8[1m]":{"t1":45,"t2":35},"claude-sonnet-5":{"t1":25,"t2":35},"claude-sonnet-5[1m]":{"t1":25,"t2":35}},"severityBySite":{"compactFabCheck":"on","handoff":"on","investigator":"on","sandboxNetwork":"on","workflowGate":"on"},"twoStageClassifier":true} for tengu_auto_mode_config, read as this account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.