Claude Code Auto Mode Is Now the Default: Turn It Off, or Keep It

Claude Code auto mode lets a safety classifier approve Claude's actions instead of asking you for each one, without skipping permission checks entirely, and since Claude Code 2.1.283 (2.1.284 for every account) it is the mode new terminal and VS Code sessions start in. That's why you saw "Auto mode is now Claude Code's default permission mode." To turn it off, press Shift+Tab once for this session, or set "permissions": { "defaultMode": "default" } in ~/.claude/settings.json for every session. To keep it, do nothing; to pin it, set "defaultMode": "auto" in that same user file, because a project's .claude/settings.json ignores auto.

Last reviewed 2 November 2026, against Claude Code 2.1.316. The notices and "unavailable" messages below are quoted from the 2.1.316 Windows build, which I downloaded from npm into a throwaway folder and searched without installing it; the rest comes from Anthropic's permission-mode docs and changelog, linked at each point.

What is auto mode in Claude Code?

Auto mode is a permission mode in which a second model, the classifier, reviews Claude's actions in place of you. The first-run text in the 2.1.316 build puts it plainly: "Auto mode lets Claude handle permission prompts automatically. Claude checks each tool call for risky actions and prompt injection before executing, runs the ones it assesses as lower-risk, and blocks the rest."

In practice each action goes through a fixed order:

1. Your rules first. Anything your allow, ask or deny rules match resolves straight away, with a few exceptions such as dangerous rm paths.
2. Reads and edits in your project run. Read-only actions and file edits inside your working directory don't go to the classifier.
3. Everything else goes to the classifier. Shell commands, network requests, MCP tools and subagents are reviewed before they run.
4. A block comes back as a reason. Claude receives the rule that blocked it, tries a safer approach, and the call is listed in /permissions under Recently denied, where r retries it with your manual approval.

The status bar shows ⏵⏵ auto mode on while it's active. Auto mode also nudges Claude to keep working instead of stopping for clarifying questions, which is the most visible change from Manual.

Why did Claude Code start in auto mode?

Because auto mode is now the built-in starting mode. From Claude Code 2.1.283, the docs say interactive terminal and VS Code sessions start in auto mode on every plan and provider when nothing else picks a mode. The changelog rolled it out in two steps: 2.1.283 for third-party providers and telemetry-off sessions, then 2.1.284 for everyone. Before that, auto was the starting mode only on Pro, Max, Ultra and Team plans in sessions that fetched feature flags, per the permission modes docs.

The first session that starts this way shows a one-time notice. In the terminal it appears once at the top of the session:

Auto mode is now Claude Code's default permission mode.

In the VS Code extension it's a card on the new-conversation screen that stays until you dismiss it. If you had already set another defaultMode in ~/.claude/settings.json, nothing changes: your sessions keep starting in that mode, and on Pro, Max, Ultra and Team plans Claude Code asks you once whether to switch: "Make auto mode your default permission mode?"

Claude Code picks the starting mode from the first of these that applies:

1. A --permission-mode flag, or --dangerously-skip-permissions
2. permissions.defaultMode in a settings file
3. The built-in default, which is now auto for interactive sessions

Two exceptions keep the old behaviour. claude -p and Agent SDK runs start in Manual mode (from 2.1.302), so scripts don't silently get a classifier. And if any settings file sets disableAutoMode to "disable", or the session can't use auto mode, it starts in Manual.

How do I turn off auto mode in Claude Code?

Press Shift+Tab once to leave auto mode for the current session. To stop every session starting in it, set "permissions": { "defaultMode": "default" } in ~/.claude/settings.json. For one launch, run claude --permission-mode default. Admins can remove it for everyone with disableAutoMode.

For this session: press Shift+Tab

From auto mode, the first press of Shift+Tab switches to Manual, shown as a gray ⏸ manual mode on. Further presses cycle Manual, accept edits and plan mode, then back to auto. In VS Code, click the mode indicator under the prompt box; in the desktop app, use the mode selector.

For every session on your machine: set defaultMode

Add this to ~/.claude/settings.json:

{
  "permissions": {
    "defaultMode": "default"
  }
}

default is the config name for Manual mode, and Claude Code accepts "manual" as an alias. The next session starts with ⏸ manual mode on. If you'd rather start in accept edits or plan mode, use "acceptEdits" or "plan" instead. A project's .claude/settings.json can set default, acceptEdits, plan or dontAsk for that project only, and it outranks your user file: a project that sets default overrides an auto in your user file, but a project can't set auto itself.

For one launch: use the flag

claude --permission-mode default

In the VS Code extension

The extension has its own setting. Set claudeCode.initialPermissionMode in your VS Code user settings to default, acceptEdits, plan or bypassPermissions. It never reads a project's .claude/settings.json for the starting mode, and it remembers the mode you last picked from the indicator, so picking Manual once also sticks.

For a whole organization

Set "permissions": { "disableAutoMode": "disable" } in managed settings. That removes auto from the Shift+Tab cycle, makes --permission-mode auto start in Manual, and switches a running auto session out with the message auto mode disabled by settings. Setting defaultMode in managed settings instead changes where sessions start while still letting people choose auto.

How do I turn auto mode on, or make it my default?

On 2.1.283 or later (2.1.284 for every account) auto is already your starting mode, unless a --permission-mode flag or a permissions.defaultMode setting picks another. Otherwise:

• Right now: press Shift+Tab until the status bar shows ⏵⏵ auto mode on. Auto only appears in the cycle when it's available to your session.
• From a permission prompt: in Manual and accept edits, a Bash permission prompt offers Yes, and switch to auto mode (2.1.247 or later).
• After a plan: approving a plan offers Yes, and use auto mode.
• For one launch: claude --permission-mode auto. This is also how to get auto mode in claude -p.
• As your default: "defaultMode": "auto" under permissions in ~/.claude/settings.json.

That last one has a trap. "auto" has no effect in a project's .claude/settings.json or .claude/settings.local.json; Claude Code ignores it there and falls back to the built-in default. If you set auto and your sessions still start in Manual with no error, that's almost always why. Move it to the user file. In VS Code, claudeCode.initialPermissionMode doesn't accept auto either: leave it unset and pick Auto from the mode indicator once.

How is auto mode different from accept edits, plan mode and bypass permissions?

Auto mode is the only mode that runs shell commands without asking while a classifier model still reviews them. Accept edits only skips edit and basic file-command prompts, plan mode blocks edits until you approve a plan, and bypass permissions skips review entirely.

Auto mode vs accept edits. Accept edits saves you the edit prompts but still stops for every other shell command, so a test run or a git command asks. Auto mode stops asking for those too and puts the classifier in your place. If what bothers you is only the edit prompts, accept edits is the smaller change.

Auto mode vs plan mode. They work together rather than compete. Plan mode keeps Claude from editing until you approve a plan; with auto mode available, its exploration commands go through the classifier instead of prompting. Approving the plan with Yes, and use auto mode carries on in auto.

Auto mode vs bypass permissions (--dangerously-skip-permissions). Both remove the prompts. Bypass removes the checks too: every action runs immediately, which is why Anthropic says to use it only in containers and VMs, and why on Linux and macOS it refuses to start as root. Auto mode keeps a reviewer. Deny rules apply in both. If you were reaching for --dangerously-skip-permissions to stop the interruptions, auto mode is usually the better trade; the sandbox and Docker guide covers when you really do need bypass.

What does auto mode block, and what does it allow?

Out of the box the classifier trusts your working directory and the git remotes configured when the session started, and treats everything else as external. Among many others, it blocks by default:

• Downloading and running code, like curl | bash
• Production deploys and migrations, and terraform destroy
• git push --force, and git reset --hard, git clean -fd or git checkout -- . that would discard uncommitted work
• Sending secrets or sensitive data to outside endpoints, or printing a live token into the transcript
• Deleting files that existed before the session, and mass deletes in cloud storage
• Starting another agent with --dangerously-skip-permissions

It allows local file work in your project, installing dependencies your lock files declare, read-only HTTP requests, and pushing to any branch of the repository you're in, apart from deploy branches like production or gh-pages. claude auto-mode defaults prints the full rule lists as JSON.

Three behaviors catch people out:

• Broad allow rules are dropped while you're in auto mode. Bash(*), wildcard interpreters like Bash(python*), package-manager run commands and Agent rules are set aside on entering auto mode and restored when you leave. Narrow rules like Bash(npm test) stay.
• What you say in the conversation counts. "Don't push" becomes a block until you lift it. But those boundaries aren't stored as rules, and compaction can drop the message that set them. For a hard limit, write a deny rule.
• Repeated blocks pause it. Three blocks in a row or 20 in a session and auto mode pauses and Claude Code goes back to prompting; approving the prompted action resumes it. The thresholds aren't configurable.

Why is auto mode unavailable, missing or not working?

When auto mode can't run, it disappears from the Shift+Tab cycle and sessions that would start in it start in Manual instead. The status line names the reason. These are the exact messages in the 2.1.316 build:

Two other cases look like "auto mode isn't working" but aren't on that list:

• It's set but sessions start in Manual, with no message. "defaultMode": "auto" is in a project settings file, where it's ignored. Move it to ~/.claude/settings.json.
• Auto mode is on but blocks everything, even pwd. That's the safety check failing to answer, not the mode being off. Messages like Auto mode is unavailable — the server returned no safety verdict and "cannot determine the safety of" belong here, and Claude Code auto mode "gave no verdict" walks through the fixes. My error page for the same message has the short version.

If auto mode disappeared after an update, check whether you're on a model it supports, and run /status: the Auto mode server row shows whether the server is reviewing your session's actions.

Does auto mode use more tokens or cost more?

It depends on your account. Each check Claude Code sends to the classifier includes part of the transcript plus the pending action, and the default classifier model is Claude Sonnet 5, whatever model you chose with /model.

• Pro, Max, Ultra and Team plans: no separate classifier charge is listed for these plans, and the billing notice about classifier requests never appears on them.
• Enterprise, the Claude API, Claude Platform on AWS, Bedrock, Agent Platform and Foundry: Claude Code's own classifier calls count toward your token usage.
• Server-side review: where the server checks actions as part of your normal model request, there are no separate classifier calls at all. /status shows Auto mode server: Enabled when that's happening.

Reads and edits inside your project skip the classifier, so the overhead comes mostly from shell commands and network calls. If you saw "We're changing auto mode to no longer charge for classifier requests" followed by "this session isn't eligible", that's a gateway issue covered in auto mode classifier billing. For a model-by-model cost estimate, the LLM cost calculator does the arithmetic.

How do I stop auto mode blocking safe commands?

Run /auto-mode-setup, or list what you trust in autoMode.environment. Most false blocks come from the classifier not knowing what you trust: your company's buckets, internal registries, deploy hosts. Two ways to tell it:

• /auto-mode-setup reads your project and recent sessions and drafts environment entries for you to review before saving. From 2.1.304 it also works on Bedrock, Vertex, Foundry, the Claude apps gateway and telemetry-off sessions.
• autoMode settings: autoMode.environment lists trusted infrastructure, and autoMode.allow adds exceptions to the block rules. Include "$defaults" in an allow list you write, or you replace the built-in exceptions instead of adding to them. Anthropic's auto mode configuration guide has the full format.

To keep a human checkpoint inside auto mode, for example before every git push, add a permissions.ask rule such as Bash(git push *). Ask rules still prompt in auto mode. My Claude Code settings builder writes the permissions block, including defaultMode and ask rules, without hand-editing JSON.

Is Claude Code auto mode safe?

Safer than skipping permissions, and not a guarantee. Anthropic's own docs put it in a warning: auto mode "reduces permission prompts but does not guarantee safety." The classifier never sees tool results in Claude Code's own classifier requests, so a hostile web page can't talk to it directly, and a separate server-side probe flags suspicious tool results before Claude reads them. But it makes judgment calls, and boundaries you state in chat can be compacted away.

The practical setup: let auto mode handle the routine prompts, keep deny rules for anything that must never happen, add ask rules for steps you want to see, and commit before long runs. For unattended work, put a sandbox or container around it. And if it's already too late, Claude Code deleted my files covers what you can get back.

What changed in auto mode recently?

FAQ

Auto mode is one corner of a bigger picture: the full list of Claude Code errors and fixes covers the rest, and the plan mode guide pairs well with this one. Setting up coding agents so teams can run them with fewer prompts and no surprises is part of the work I do: see recent projects.