Claude Code Starts Auto Mode on August 14: What's in Its Rulebook

Anthropic announced that from August 14, Claude Code will start in auto mode for new sessions on Pro, Max, and Team plans. In this mode, instead of a dialog asking for permission, a separate classifier evaluates each tool call. Users who have already set a default mode may receive a one-time question to switch, but defaults set by administrators are not changed. Enterprise, API, Bedrock, Vertex, and Foundry users remain on the opt-in for about another month. The rules for the classifier are stored locally; on build 2.1.226, the command `claude auto-mode defaults` prints them. The rules include 17 allow, 65 soft_deny, 1 hard_deny, and 20 environment entries, totaling 60,149 characters of English prose. The only hard_deny rule is about data exfiltration, which is also the longest at 5,278 characters, explaining to look at the eventual recipient and that base64 doesn't change the nature of transfer. On a clean machine, only a third of the environment profile is filled: thirteen fields are set to None configured, so the only trusted object by default is the repository where the session started and its remote. Users are advised to fill these fields by August 14: where production is, which domains and buckets are internal, and how secrets are managed. The permission dialog is not removed; the classifier blocks what it considers irreversible, destructive, or outward-directed. After three consecutive blocks or twenty in a session, auto mode pauses and Claude Code reverts to asking; approving a request resumes auto mode. Thresholds are not configurable. Auto mode also disables broad allow rules like python:*, which would let commands bypass the classifier; narrow ones like Bash(git *) work as before, and permissions.deny is checked first and is independent of the model.