Dossier · Ongoing
Claude Code's auto mode
From the August 14 default rollout to the bypass via a crafted ZIP file: Anthropic's automatic command approval, tracked over time.
On August 14, 2026, Anthropic replaced manual per-command approval in Claude Code with a classifier meant to stop risky tool calls on its own. The company justified the switch with an in-house study in which testers waved through nine out of ten dangerous commands during manual review – and with a commissioned red-team test across 72 attack scenarios in which no attempt succeeded.
Two weeks later, security researcher Johann Rehberger demonstrated an attack chain that bypasses auto mode in up to 80 percent of test runs: a crafted ZIP file uses Python module shadowing to make Claude Code load foreign code instead of the standard library. Anthropic classified the report as informational and explicitly calls auto mode a convenience feature rather than a security guarantee. This dossier tracks how automatic approval evolves between convenience and attack surface.