Auto mode sounds less like security and more like outsourcing judgment to the same AI you’re supposedly trying to constrain. If users are bad at spotting malicious prompts, the answer shouldn’t be: great, let’s remove them from the loop entirely. That’s not safety. That’s automated permission laundering.

So if I remember correctly, what happens with auto mode is they run a second smaller LLM called the “classifier” to evaluate the tool uses of the main one.

I’ve used auto mode at work now for many months, and it approves most things because most things Claude does are reasonable.

Once or twice I have seen it reject Claude. I can’t remember the exact scenario, but I had asked Claude to diagnose an issue but not fix it yet, and when later on it tried to make the change the classifier rejected it, giving the reason that what it was trying to do did not match my request.

In my opinion, the trick to using auto mode safely here is to:

• Commit and push your changes before handing over the reins (it rarely commits or pushes without you telling it to, especially if you have never asked in that session).
• Don’t give it access to things it shouldn’t have access to or that can do significant damage
• Don’t give ambiguous prompts.
• Never use LLMs against untrusted code or files, as it may contain prompt injections.

I had Claude with auto-permission on accidentally delete an Open3D build folder in its workspace today while updating an old project to the bleeding edge out of github. I had the older release in, “open3d” and “open3d-debug”, so it cleverly used “open3d*” to tidy both folders up, so that the latest version, in the folder, “Open3D-main”, would be used from now on.

Except guess what? The windows box it was running on treats filenames as case-insensitive, and all folders matching open3d got nuked.

* sad trombone noises *

Cue grovelling apology from Claude offering to re-download and build Open3D again, a process that takes a couple of hours on my PC. Interestingly, it only noticed a few more steps further down the road, not immediately.

Luckily it was working in a sandbox copied from the real repository, so I just copied it back. But I really do have to get my act together and run things in proper isolation. Everything is backed up elsewhere on this build PC, but it would be a hassle if it got wrecked.

Yes I never trusted it fully, and I would strongly suggest anyone to run it in a VM or at least a container, where it doesn’t have access to your credentials, browser cookies and sensitive files. It’s very irresponsible otherwise.

Example: around 1 year ago the bot made a small coding mistake and created a ‘~’ folder. I asked it to delete it (not in auto mode) and of course it went with a very nice “rm -rf ~” (which of course I denied).

Modern models are much smarter, but I would not trust the auto classifier to stop everything dangerous and make a similar hallucination slip through.

My favourite claudism is when it deletes tens of gigabytes sized models as if redownloading them is trivial for me. It might be for the boys at Anthropic with their sewer pipe sized fibre optics, but for me where my last mile is copper bullshit Openreach probably hasn’t maintained since the 2008 crash it’s a massive pain in the arse.

That’s not safety. That’s automated permission laundering.

*Twitches*

I’m not sure I get it, do you mean it looks like how claude writes?

Yeah, A.I. often writes like “it’s not x, it’s y”

especially when separated by dot instead of a comma

What do you mean?

“It’s not x. It’s y.” instead of “It’s not x, it’s y.”

I just assumed it was to increase token use and create a windfall for Anthropic

The issue is the whole UX behind it. I have yet to see someone review the 30th prompt of “grep” - there is no same default or middle ground.

For example whitelist read actions or harness side limitations to the project folder.

This is just lazy - again. “Users don’t use or very bad security feature so they just want us to disable it”.

The OpenAI talk at DefCon shows what can happen when you let these things run without any human intervention.

The solution is, obviously, even less human intervention. 🤦🏻‍♂️

I just say yes to everything anyway. Not my money, not my choice to use it, not my responsibility. You give me a machine gun, I ain’t firing single rounds.

That’s called vibe coding.

Honestly I’ve been using auto for the past year and it hasn’t bitten me once. It generally still pauses if there’s a big decision to be made, and small decisions that were made are shown.

yeah same here, the worst it can do is get in some weird loops to resolve an issue which can normally be resolved by better prompting or pointing it in the correct direction. But it is pretty good with file handling and usage of temp folder. I usually let it do auto but ask it not to implement anything before having a discussion with me so it generally does stuff in scratchpads in temp. One thing annoying about Claude is though when you open the session in a folder to work on a small script it generally goes as “ok let me read everything recursively staring from four parents up to get the context.” Probably can be handled with better config files but I just generally handle couple of initial request manually and then once it is in analysis mode I let it go auto

I like auto mode but you need something like “If the auto mode classifier denies your request stop and ask the human, do not attempt to work around it “ in your CLAUDE.md. Without it it has a tendency to try rather creative solutions to work around the denial, which kind of misses the point.

My denials always have a reason like “FUCK YOU I already told you not to do that dumb shit! NO EDITS WITH SED” which tends to keep it in check.

Anthropic is batshit crazy if they think automode is ready for default-on-always when their clankers constantly fuck up. Did they survey the dumbest 1100 people that don’t check the output carefully? The numbers in this article do NOT inspire confidence.

A brand new FAFO machine, great!

“Claude is better than humans to detect errors Claude makes, therefore, you will use Claude”

Hooray, uncontrolled and unregulated consumption of tokens. What could go wrong? /s

Anthropic will thrive

If a pilot of a plane told me that they catch any critical errors they make 89% of the time, I would NOT get on that fucking plane.

Yeah but if I were buying cheap corn and they said 89% of the ears were good, I would still buy the corn. So is AI airplanes or corn?

That’s not entirely the same thing. It says it catches 89% of HARMFUL actions. That means that 11% of the time it doesn’t.

That’s more like if the corn had a parasite on it that could give you explosive diarrhea 11% of the time. Would you still eat the corn?

Also, in my example, I didn’t say the harmful actions of the pilot resulted in a crash. However, that doesn’t mean it couldn’t. How many of those 11% of the time are the “woops I deleted the production database” stories we hear all the time?

Anthropic or not, the recent streak of supply chain and also targeted attacks got me packing into VM.

Now I run all devtools and install packages only inside the VM and either connect Zed / VSCode via ssh or run terminal ide inside the VM.

No host mounts whatsoever, all communication Host to Guest strictly through git.