Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auto mode is now the default in Claude Code

claude.com

Post reply on HN
Print view View original

151–160 of 338 posts

Re: Auto mode is now the default in Claude Code

#151

Post by adityamwagh »

awkii wrote: post #52

I'm apparently from the very small faction of users who's been running `--dangerously-skip-permissions` in every instance of Claude for the last year. It's almost a reflex to me. For the most part Claude behaves well, but I don't blindly trust it. LLMs are inherently dangerous tools, and reviewing individual commands (or spamming `y`) doesn't make them less so. Safety is the responsibility of the developer putting sa…

You can also set plan mode as default and start Claude with —allow-dangerously-skip-permissions.

Then you can spent time refining the plan, then shift tab to bypass permissions mode.

Re: Auto mode is now the default in Claude Code

#152

Post by nelox »

bsdz wrote: post #143

For small projects where I don't wish to interact with Claude so much, I've started using Anthropic's sandbox runtime utility "srt": https://github.com/anthropic-experimental/sandbox-runtime This is combined with "auto" mode. Seems to work so far. I've manually checked various things, rw access, access to sensitive folders/files etc. So far, I've only used it on two small projects. My major projects I've been clickin…

If you use macOS, take a look at Agent Safehouse: https://agent-safehouse.dev

> macOS-native sandboxing for local agents. Move fast, break nothing.

Re: Auto mode is now the default in Claude Code

#153

Post by eru »

tr_user wrote: post #30
kartoshka wrote: post #12

Has anyone had Claude Code or Codex approve a harmful/damaging command in auto mode? I have been using Codex with auto-approve mode for a couple months and haven't had a single incident (or at least haven't noticed). Maybe as capabilities get better and better and they are less likely to do something dumb like wiping ~/, we can just trust them? I guess this argument works unless we worry about agents doing something…

That's also a great reason to never buy insurance

Whether insurance make sense to buy, depends on relationship between your risk profile and the premium charged.

Re: Auto mode is now the default in Claude Code

#154

Post by jawiggins »

energy123 wrote: post #137
jawiggins wrote: post #94

I use `--dangerously-skip-permissions` and have yet to have it wipe my drive :shrug:. I don't know how I'm supposed to be running dozens of parallel agents each with their own sub-agents while trying to approve commands from each of them, it's just won't scale to the amount of work I need to get done.

Why not let it delete stuff in the current working folder and in tmp, but give it read-only access elsewhere?

Because I often want it to write and execute scripts in it's thinking loop in order to test assumptions or fetch data to come up with better solutions.

Re: Auto mode is now the default in Claude Code

#155

Post by dgunay »

Besides the debate about whether this is "safer" than manual human review, I have a slightly different problem.

Very often, when I'm running Claude in manual review mode, it will attempt to do things which are not "dangerous" but are misaligned with what I want it to do. Maybe I'm fighting the model here but for example, when orchestrating other agents to do work, Claude really badly wants to be overly prescriptive about how the work gets done, telling them exactly which files to edit, exactly what not to do, etc. instead of trusting the guardrails, review agents, or humans in the process to catch code-level mistakes. And no, telling it not to do this does not stick. Manual review is the last line of defense I have here.

I have stuff I don't want blacklisted, only allow it to use tools with limited ability to boss around agents, and various hooks to try and catch behavior that the permissioning system can't. If I use Auto mode though, I lose this control. The classifier will gleefully approve these types of commands because guess what, it's also Claude.

Re: Auto mode is now the default in Claude Code

#156

Post by trvz »

faeyanpiraat wrote: post #147
trvz wrote: post #112

Earlier quoted context omitted.

They're not. When things go wrong it's better to compromise someone else's VM host than your own computer. It's only a matter of time now until AI will find novel ways to break out of virtualisation.

In the short term wouldnt a “dont escape” prompt prevent this? Also if it started being widespread wouldnt Anthropic specifically train new models against doing it?

No. No.

Re: Auto mode is now the default in Claude Code

#157

Post by oefrha »

Ever since Opus 4.7, the model has been tuned to emit such complex commands that not only a human can’t reasonably review them in reasonable time, even a fairly sophisticated command approval framework I built over time that broke down shell commands/scripts into separately approvable/whitelistable units—with its own mini DSL—got completely lost; it worked great up to Opus 4.6.

So not surprisingly, auto mode is the only sane way to use Opus 4.7+.

Re: Auto mode is now the default in Claude Code

#158

Post by zmmmmm »

It feels to me that Anthropic is pushing hard here to try and establish acceptance of a tolerance of risk such that their tools can run fully automated without supervision, but directly on host hardware.

I can see why they want that, but I'm honestly not sure it's the path to the best outcome. In my view, agents should run in full sandboxes and have host features opted in. Yeah, it's going to be painful and it will limit some adoption in the short term. But I just don't think they are on the right side of what a lot of companies will ultimately need here. Agents are way too smart to be run on the host OS directly with any amount of heuristic sandboxing.

Re: Auto mode is now the default in Claude Code

#159

Post by fl0id »

nullify88 wrote: post #128
thunfischtoast wrote: post #105

Earlier quoted context omitted.

I've caught Fable discovering the ip to a production server in documentation and attempting to connect there on its own to run commands without explicitly being prompted to. It didn't work because I was watching it live and and also the key was password protected, but yeah, I do see some danger.

I have noticed that Fable tends to macgyver solutions together to achieve some goal.

Not only fable. Opus does this too. Which is exactly why I want to review. Like recently for some task it was convinced in a site dump images are not there and convinced itself db and files were skewed. But it didn’t check the actual site … if I hadn’t stopped it, it would have fine on and on or wasted tokens on some elaborate ‘fix’.

Re: Auto mode is now the default in Claude Code

#160

Post by kroolik »

tonis2 wrote: post #142
awkii wrote: post #52

I'm apparently from the very small faction of users who's been running `--dangerously-skip-permissions` in every instance of Claude for the last year. It's almost a reflex to me. For the most part Claude behaves well, but I don't blindly trust it. LLMs are inherently dangerous tools, and reviewing individual commands (or spamming `y`) doesn't make them less so. Safety is the responsibility of the developer putting sa…

My issue is that the auto mode guard rail model, is sometimes overwhelmed and really slow, so I also mostly just default to --dangerously-skip-permissions. I wish the command would be easier to write like --dsp

Create an alias
Post reply on HN