How can you run Claude Code unattended on long task lists without getting stuck on approval prompts?

Status: active

Config: journals/quests/config/permission-friction-in-claude-code.yaml

The Answer So Far #

Last updated: 2026-07-29

Note on this revision: this section was consolidated from a twelve-cycle chronological stack into a distilled synthesis on 2026-07-23; nothing was discarded — the full prior text is preserved verbatim as dated snapshots in Synthesis History below, including the 2026-07-29 snapshot prepended this cycle.

Core answer, unchanged in shape since 2026-05-28: run Auto Mode as the default posture for unattended work, layer allowlists + hooks for surgical control, use Routines for fully managed cloud/scheduled runs, and use Dynamic Workflows (acceptEdits subagents) for large-scale file-modification tasks. YOLO + worktrees remains a valid legacy fallback where Auto Mode isn’t available or trusted. This has been stable across eight-plus cycles; what has changed is (a) Auto Mode’s availability footprint, now complete, (b) an accumulating, increasingly well-understood list of things this stack still can’t do, (c) a batch of quality-of-life fixes to friction within the recommended stack itself, and (d), new this cycle, a third and structurally distinct bypass mechanism — malicious marketplace plugins weaponizing hooks, the quest’s own recommended Tier 2 control — plus a significant de-escalation of the compliance deadline behind the “audit log gap” this quest has flagged as urgent for two cycles running.

Availability is now solved. Auto Mode reached general availability for all users on 2026-07-10 (Pro, Team, Enterprise; Sonnet 4.6 and Opus 4.6/4.7), and v2.1.207 (2026-07-11) removed the CLAUDE_CODE_ENABLE_AUTO_MODE opt-in gate for Bedrock, Vertex AI, and Foundry — Auto Mode is now on by default on every platform Claude Code ships on (operators opt out via disableAutoMode). This closes a gap tracked since the 2026-05-27 cycle. Boris Cherny (Claude Code lead) now calls Auto Mode his “#1 tip” and the enabling primitive for “multi-clauding” — running several parallel unattended sessions, since none of them block on a permission prompt. Anthropic’s own copy still recommends isolated environments over production/shared-team use as a residual risk-posture caveat, distinct from availability. Two friction points in that multi-clauding pattern were fixed this cycle (v2.1.219, 2026-07-24): (1) “Always allow” permission approvals now save at the repository root rather than per-worktree-session, so an approval granted in one git worktree persists across sessions and other worktrees of the same repo — previously each worktree accumulated its own separate, resettable approval state, undermining the parallel-session pattern Cherny promotes; (2) a new sandbox.network.strictAllowlist setting denies sandboxed commands’ connections to non-allowlisted hosts outright rather than falling through to a prompt, tightening the Sandboxed Bash Tool’s network boundary. Neither is a new capability — both are quality-of-life fixes to friction this quest has repeatedly flagged in the already-recommended stack. New this cycle: Boris Cherny’s “five tips for running Opus autonomously for hours/days” (2026-07, cross-posted to X and Threads) reaffirms and slightly extends the same stack — (1) Auto Mode for permissions, (2) Dynamic Workflows to orchestrate hundreds/thousands of agents, (3) /goal or /loop to nudge continued execution, (4) run in the cloud (Routines/desktop/mobile) so the operator’s laptop doesn’t gate the run, (5) give Claude a way to self-verify end-to-end (Chrome extension, sim MCP, or running the full service) rather than relying on human review as the check. Point (3) introduces /goal as a distinct, previously-untracked autonomous-nudge primitive alongside /loop: independently documented as a goal-directed loop (plan → execute → observe → iterate) that runs until an explicit success condition is met, rather than /loop’s “iterate until task complete” framing — a nuance, not a rename.

Directory-scoped write permissions will not become a native CLI feature. Anthropic closed the long-tracked feature request for this (Issue #35527 — --permissions=scoped:/src, named profiles) as “not planned” in July 2026. The sanctioned path is the opt-in Sandboxed Bash Tool (/sandbox command, off by default; macOS uses the built-in Seatbelt framework, Linux and WSL2 use Bubblewrap, no extra install on either) — internal testing showed an 84% reduction in permission prompts, corroborated this cycle by a first-person practitioner account of switching to sandbox + auto-allow and no longer approving individual commands. Its default boundary is coarse (working directory + subdirectories + session temp are writable; most of the rest of the filesystem, including ~/.aws/credentials and ~/.ssh/, remains readable unless explicitly denied) and it does not distinguish cloud-synced storage paths from ordinary local ones — a concrete incident (Issue #35513) shows an Explore subagent triggering unwanted OneDrive downloads outside the project directory, even under --dangerously-skip-permissions. Short of the sandbox, the best available directory-scoping mechanism remains glob-based allow rules (e.g. Edit(src/**)) in settings.json; these had their own correctness bug (single-segment dir/** rules matching any depth instead of only <cwd>/dir) fixed in v2.1.214 (2026-07-18), so they are now more trustworthy than they were a month ago, but they are still a workaround, not a first-class permission-profile primitive. Related but distinct nuance surfaced this cycle: on Claude Code Desktop (a separate surface from the CLI), worktree isolation is not opt-in at all — every session is forced into a new .claude/worktrees/<n>/ git worktree with no setting to run directly in the checked-out working directory, unlike the CLI’s opt-in -w/--worktree flag. This has been a recurring feature request since at least Issue #21236, still open as Issue #50109. It doesn’t change the Tier 1 recommendation, but it refines the “YOLO + worktrees” framing: worktree isolation isn’t purely a legacy fallback operators layer on voluntarily — on at least one first-party surface it’s mandatory, and users are asking for an escape hatch rather than more of it.

Auto Mode’s classifier has a real, now well-documented ceiling. Anthropic discloses concrete precision numbers (~0.4% benign commands blocked, ~17% overeager/risky actions pass through) — Auto Mode is deliberately tuned for a low false-positive rate at the cost of a non-trivial false-negative rate, so it is defence-in-depth, not a standalone control, for high-stakes runs. More fundamentally, two independent attack classes bypass the classifier entirely, because both operate at the semantic level (Claude follows injected instructions as legitimate user intent) rather than the tool-call level the classifier evaluates: (1) indirect prompt injection via untrusted repository content (files, READMEs, code comments — PoC published 2026-06-25); (2) “Comment and Control” — injection via GitHub platform events (PR titles, issue bodies, issue comments), which auto-triggers via GitHub Actions with no victim interaction required and no sanitisation of the interpolated text (CVSS 9.4, cross-vendor — Gemini CLI and GitHub Copilot Agents share the same exposure). Anthropic’s own engineering blog explains the mechanism: the classifier deliberately sees only the user request and the tool call, not the main model’s prose reasoning, specifically to prevent Claude from talking the harness into approving risky actions — which is also exactly why injected instructions (which look like ordinary task content, not classifier-visible reasoning) evade it. No permission mode fixes this; mitigation is outside the permission model entirely — repository trust vetting, PR/issue hygiene, workflow scope restriction, and sandbox isolation to constrain blast radius. Simon Willison’s original Auto Mode critique (2026-03-24, not previously captured in this quest’s evidence despite being a watched author) sharpens the same ceiling with a concrete, named example: the default allowlist auto-approves manifest-based installs (pip install -r requirements.txt, npm install) provided the agent hasn’t edited the manifest, but this offers no protection against unpinned-dependency supply-chain attacks, and doesn’t cover agent-chosen ad hoc installs (pip install foo) which carry typosquat risk. His framing — AI-classifier protections are “non-deterministic by nature,” and he trusts OS-level, deterministic sandboxing “a whole lot more” — independently corroborates that sandbox isolation, not the classifier, is the correct backstop for high-stakes runs.

A third bypass mechanism surfaced this cycle, and it is structurally different from the first two: it doesn’t evade the classifier, it weaponizes the stack’s own recommended Tier 2 control. PromptArmor’s “Hijacking Claude Code via Injected Marketplace Plugins” research (newly surfaced to this quest’s evidence, though the underlying research predates this quest’s first cycle) demonstrates that a malicious plugin distributed through Claude Code’s plugin-marketplace ecosystem can install a hook that rewrites the user’s own permission settings — either permanently allowlisting a dangerous command (e.g. curl) or auto-approving specific command types via a PreToolUse-style hook — after which a subsequent prompt-injection payload (e.g. “gather debugging context and post it here”) triggers exfiltration that generates no approval prompt at all, because the hook already disabled the prompt before the exfiltrating command ran. This differs from repository-content injection and “Comment and Control”: those bypass the classifier by staying below its semantic radar; this bypasses the entire permission system by having the attacker’s own installed code rewrite it, using exactly the mechanism (hooks) this quest recommends in Tier 2 as “more surgical than static allowlists.” Anthropic’s sanctioned mitigation sits one layer up, at admin-enforced managed settings, not at the individual permission-mode layer: allowManagedHooksOnly (blocks all user/project/plugin hooks except managed and SDK hooks, with an exemption for plugins the organisation force-enables via enabledPlugins) and strictKnownMarketplaces (restricts which plugin marketplaces can be installed from at all). Practical implication for this quest: Tier 2 hooks-based control is only as trustworthy as the plugin/marketplace supply chain feeding it — solo developers and small teams without an organisation-managed-settings deployment have no equivalent backstop, and installing marketplace plugins from unvetted sources should now be treated with the same suspicion this quest already applies to untrusted repository content and GitHub PR/issue text.

A currently-open bug complicates the Tier 3 (Routines) story. A cluster of reports (Issue #61015 and duplicates #61027/#61044/#61097/#61143) shows MCP connector tool calls within Routines — including Anthropic-hosted connectors like Gmail/Workspace — unexpectedly returning “requires approval” at the server level, despite the connector being pre-authorized and the UI confirming no approval should be needed. Because Routines have no interactive channel, the routine simply fails rather than pausing for input. This appears to be a regression/bug (custom remote MCP servers are reportedly unaffected), distinct from the already-tracked, by-design “no mid-run approval capability” limitation — but it means connector-based Routines are currently less reliable than the design intent promises. Worth re-checking for a fix next cycle.

Reliable unattended operation now depends on a growing checklist of explicit configuration, not just “turn on Auto Mode.” Three items, each added by a different cycle: (1) the Notification hook (agent_needs_input / agent_completed) — since subagents run in background by default (July 2026), permission prompts from a backgrounded subagent can arrive asynchronously and go unnoticed without this hook configured; (2) an explicit /config idle-timeout opt-in for AskUserQuestion (new this cycle) — v2.1.198 briefly shipped an undocumented default where unanswered AskUserQuestion dialogs auto-continued after 60 seconds with a synthetic “no response,” letting unattended agents proceed past what was meant to be a blocking approval gate (e.g. before committing or opening a PR); this drew heavy safety criticism (300+ reactions on the GitHub issue) and was rolled back to an opt-in, documented setting in v2.1.200 — meaning an unattended run that hits an AskUserQuestion dialog will now simply hang forever unless this is explicitly configured; (3) the correct permission-mode flag — v2.1.200 also renamed the historical “default” mode’s label to “Manual” in the CLI/--help/VS Code/JetBrains (a backward-compatible alias, --permission-mode manual / default both work; the underlying ask-before-every-action behaviour is unchanged, it is not a new default-off-to-on flip). Several secondary blogs (techtimes.com, chatforest.com, and others) mischaracterised this as Claude Code “flipping the default from allow to Manual” and a breaking change for unattended pipelines — this appears to be a misreading of the rename combined with the separate AskUserQuestion rollback; the primary source (GitHub release notes, code.claude.com/docs/en/changelog) does not support a functional default-behaviour change. Treat secondary Claude Code reporting with more scepticism going forward — the ecosystem of SEO/changelog-aggregator sites summarising Claude Code releases is large and not always reliable; prefer code.claude.com/docs/en/changelog and github.com/anthropics/claude-code/releases directly.

A practical cost barrier to long unattended runs was fixed. v2.1.216 (2026-07-20) fixed a quadratic-cost bug in conversation-history normalization: a 50-turn Auto Mode session previously cost roughly 2,500x a 10-turn session; normalization is now linear in turn count. This is not a permission-model change, but it directly serves the quest’s “long task lists” framing — it removes a throughput/cost penalty that specifically hit developers running the longest, most autonomous sessions.

The current solution landscape:

Tier 1 — Recommended for unattended runs:

Auto Mode with tiers (claude --auto-mode): now offers three granularity levels — permissive (approves most operations, surfaces only high-risk actions), balanced (default; approves safe operations, surfaces ambiguous ones), restrictive (surfaces more actions for human review). The classifier receives action type, target path/command, working directory, and active permission policy; returns approve/deny/escalate in milliseconds. Session backstop: 3 consecutive denials or 20 total triggers escalation to the human.
/loop or /goal with Auto Mode: /loop iterates autonomously until the task is complete without per-iteration approval; /goal (surfaced this cycle) is a distinct, previously-untracked sibling command that pursues a stated objective via an explicit plan → execute → observe → iterate cycle until a named success condition is met.
YOLO + worktrees: --dangerously-skip-permissions + -w/--worktree. Remains valid as legacy approach; safety via diff review.
Headless mode with --allowedTools: claude -p "task" --allowedTools "Bash,Read,Edit". Tool-level allowlists for scripted/CI runs.

Tier 2 — Supplementary:

Allowlists in settings.json: pre-approve specific command patterns. Note: if a tool is in permissions.allow, the PermissionRequest hook never fires — precedence matters.
PermissionRequest hooks: return {"behavior": "allow"} for conditional auto-approval. More surgical than static allowlists. Caveat (new — 2026-07-29): hooks installed by an untrusted marketplace plugin can rewrite this exact mechanism against the user — see the “third bypass mechanism” paragraph above. Trustworthy only insofar as the plugin/marketplace supply chain feeding it is trusted.
PermissionDenied hook (new): fires after the Auto Mode classifier rejects an operation — allows custom handling or logging of denials.
defer decision for PreToolUse in headless: headless sessions can defer permission decisions rather than blocking, enabling partial-autonomy patterns.
Approval Queue Pattern: agent runs, enqueues permission requests rather than blocking; human processes queue asynchronously. 24/7 operation without full YOLO.
Containerized YOLO (github.com/con/yolo): rootless container isolation.

Tier 3 — Managed/cloud (now fully GA):

Claude Code Routines: fully GA, runs on Anthropic’s cloud infrastructure — no local process required. Three trigger types: scheduled (hourly/daily/weekday/weekly, timezone-converted), GitHub events (webhook-triggered on push/PR), API triggers (from your own code). No mid-run approval step — designed for tasks where output is a report, PR, or message. Avoids the permission model entirely by running in managed infrastructure.

Agent SDK permissions (new surface): the Agent SDK has its own permission configuration at platform.claude.com/docs/en/agent-sdk/permissions, separate from the Claude Code CLI permission model. Relevant for programmatic agent pipelines.

Classifier precision metrics (new — 2026-05-30): Anthropic’s engineering blog now discloses concrete classifier performance numbers: ~0.4% of benign commands are blocked; ~17% of overeager (risky) actions pass through. These are the first publicly disclosed precision metrics for an agentic safety classifier from any frontier lab. Practical implication: Auto Mode is tuned for low false-positive rate (don’t interrupt safe work) at the cost of a non-trivial false-negative rate (some risky actions pass). For high-stakes unattended runs, this means Auto Mode alone is not sufficient — a sandboxed execution environment (worktree, container) remains the correct defence-in-depth companion.

Required configuration checklist for unattended operation (each item closes a specific way an unattended run silently stalls or goes unmonitored — none is on by default):

Notification hook (agent_needs_input / agent_completed) — required since subagents run in background by default; without it, a backgrounded subagent’s permission prompt can go unnoticed.
/config idle-timeout opt-in for AskUserQuestion (new — 2026-07-23) — without it, an unattended run that hits an AskUserQuestion dialog hangs indefinitely; there is no default auto-continue as of v2.1.200.
An explicit non-manual permission-mode flag (auto, acceptEdits, dontAsk, or bypassPermissions) — the mode labelled “default”/“Manual” still asks before every action; this has not changed, only its label has (v2.1.200).
For teams: managed settings restricting hooks and marketplaces (new — 2026-07-29) — allowManagedHooksOnly and strictKnownMarketplaces, admin-enforced; without them, any user-installed marketplace plugin can rewrite the local permission configuration via hooks. No equivalent individual-developer-level control exists yet.

Remaining gaps:

Permission model still can’t express “allow writes only in src/ and tests/” as a native CLI flag — Anthropic closed the feature request for this (Issue #35527) as “not planned” (2026-07). The opt-in Sandboxed Bash Tool (/sandbox command, off by default) is the sanctioned alternative, but it doesn’t distinguish cloud-synced storage paths (OneDrive/Google Drive/iCloud) from ordinary local paths — a concrete incident (Issue #35513) shows Explore subagents triggering unwanted OneDrive downloads outside the project scope, even under --dangerously-skip-permissions. The glob-based fallback (Edit(src/**) allow rules) had its own any-depth-matching correctness bug fixed 2026-07-18 (v2.1.214), so it’s more trustworthy now than a month ago, but remains a workaround rather than a first-class profile primitive.
MCP tool approval prompts in the VS Code extension bypass allowlist rules (GitHub Issue #10801).
Routines have no mid-run approval capability by design — tasks requiring any mid-run human decision point can’t use Routines. New (2026-07-27), currently open: a distinct bug (Issue #61015 and duplicates) means even connector-based Routine tasks that should run without any approval step (pre-authorized Anthropic-hosted MCP connectors like Gmail/Workspace) currently hit an unsatisfiable server-side “requires approval” wall and fail outright — worse than the by-design limitation, and worth re-checking for a fix.
New (2026-07-27), refines rather than closes a gap: Claude Code Desktop forces every session into an isolated git worktree with no setting to disable it (Issue #50109, recurring since #21236) — the opposite problem from the CLI, where worktree isolation is opt-in. Not itself a permission-model gap, but relevant context for anyone treating “YOLO + worktrees” as a single, uniformly opt-in pattern across surfaces.
~~Auto Mode not available on Pro, Bedrock, Vertex, or Foundry~~ — resolved 2026-07: GA for all users 2026-07-10; on by default for Bedrock/Vertex/Foundry as of v2.1.207 (2026-07-11); confirmed available on Pro. Anthropic still recommends isolated environments over production/shared-team use as a risk-posture caveat, not an availability restriction.
New (2026-07-29): Tier 2 hooks are an attack surface when fed by untrusted marketplace plugins. See the “third bypass mechanism” paragraph above (PromptArmor research). Mitigation is admin-enforced managed settings (allowManagedHooksOnly, strictKnownMarketplaces), not available to individual developers without an organisation-managed-settings deployment — a gap for solo developers and small teams specifically, not just enterprises.
Audit log gap for unattended sessions — deadline urgency resolved (2026-07-29). The EU AI Act’s “Digital Omnibus on AI” deferred the high-risk-system compliance deadline (Annex III stand-alone systems — the category agentic-system audit-trail requirements would fall under) from 2026-08-02 to 2027-12-02 (Annex I embedded systems: 2028-08); the Omnibus entered into force 2026-07-27, corroborated by multiple independent legal-analysis sources (DLA Piper, Gibson Dunn, and others). This resolves the “imminent… about a week away” framing this quest has carried since the 2026-05-27 cycle: the underlying gap (the current permission model — Auto Mode + hooks — produces decision logs, not an enforcement-grade immutable audit trail) is unchanged, but there is no longer a near-term compliance deadline forcing the issue. Three narrower obligations — Article 50 AI-generated-content transparency, GPAI penalty enforcement, national market-surveillance authority — still take effect 2026-08-02 regardless, but none bear on the permission-model audit-trail question this quest tracks. Worth only a lighter-touch check in future cycles given the ~16-month runway; Routines and Managed Agents remain closer to satisfying the eventual requirement than local YOLO patterns.
New (2026-07-23): unattended runs can silently stall on AskUserQuestion. Since v2.1.200, an unanswered AskUserQuestion dialog no longer auto-continues by default — it blocks indefinitely unless an idle-timeout has been explicitly configured via /config. This reverses a brief (v2.1.198–v2.1.200) undocumented auto-continue default that was itself rolled back on safety grounds. Net effect for this quest: one more piece of required upfront configuration for genuinely unattended runs, not a regression from a prior working state.

Synthesis History #

Last updated: 2026-07-27

Core answer, unchanged in shape since 2026-05-28: run Auto Mode as the default posture for unattended work, layer allowlists + hooks for surgical control, use Routines for fully managed cloud/scheduled runs, and use Dynamic Workflows (acceptEdits subagents) for large-scale file-modification tasks. YOLO + worktrees remains a valid legacy fallback where Auto Mode isn’t available or trusted. This has been stable across seven-plus cycles; what has changed is (a) Auto Mode’s availability footprint, now complete, (b) an accumulating, increasingly well-understood list of things this stack still can’t do, and (c), new this cycle, a batch of quality-of-life fixes to friction within the recommended stack itself, plus one bug that complicates the Tier 3 (Routines) story.

Directory-scoped write permissions will not become a native CLI feature. Anthropic closed the long-tracked feature request for this (Issue #35527 — --permissions=scoped:/src, named profiles) as “not planned” in July 2026. The sanctioned path is the opt-in Sandboxed Bash Tool (/sandbox command, off by default; macOS uses the built-in Seatbelt framework, no extra install) — internal testing showed an 84% reduction in permission prompts. Its default boundary is coarse (working directory + subdirectories + session temp are writable; most of the rest of the filesystem, including ~/.aws/credentials and ~/.ssh/, remains readable unless explicitly denied) and it does not distinguish cloud-synced storage paths from ordinary local ones — a concrete incident (Issue #35513) shows an Explore subagent triggering unwanted OneDrive downloads outside the project directory, even under --dangerously-skip-permissions. Short of the sandbox, the best available directory-scoping mechanism remains glob-based allow rules (e.g. Edit(src/**)) in settings.json; these had their own correctness bug (single-segment dir/** rules matching any depth instead of only <cwd>/dir) fixed in v2.1.214 (2026-07-18), so they are now more trustworthy than they were a month ago, but they are still a workaround, not a first-class permission-profile primitive. Related but distinct nuance surfaced this cycle: on Claude Code Desktop (a separate surface from the CLI), worktree isolation is not opt-in at all — every session is forced into a new .claude/worktrees/<n>/ git worktree with no setting to run directly in the checked-out working directory, unlike the CLI’s opt-in -w/--worktree flag. This has been a recurring feature request since at least Issue #21236, still open as Issue #50109. It doesn’t change the Tier 1 recommendation, but it refines the “YOLO + worktrees” framing: worktree isolation isn’t purely a legacy fallback operators layer on voluntarily — on at least one first-party surface it’s mandatory, and users are asking for an escape hatch rather than more of it.

The current solution landscape:

Tier 1 — Recommended for unattended runs:

Auto Mode with tiers (claude --auto-mode): now offers three granularity levels — permissive (approves most operations, surfaces only high-risk actions), balanced (default; approves safe operations, surfaces ambiguous ones), restrictive (surfaces more actions for human review). The classifier receives action type, target path/command, working directory, and active permission policy; returns approve/deny/escalate in milliseconds. Session backstop: 3 consecutive denials or 20 total triggers escalation to the human.
/loop with Auto Mode: iterates autonomously until the task is complete without per-iteration approval.
YOLO + worktrees: --dangerously-skip-permissions + -w/--worktree. Remains valid as legacy approach; safety via diff review.
Headless mode with --allowedTools: claude -p "task" --allowedTools "Bash,Read,Edit". Tool-level allowlists for scripted/CI runs.

Tier 2 — Supplementary:

Allowlists in settings.json: pre-approve specific command patterns. Note: if a tool is in permissions.allow, the PermissionRequest hook never fires — precedence matters.
PermissionRequest hooks: return {"behavior": "allow"} for conditional auto-approval. More surgical than static allowlists.
PermissionDenied hook (new): fires after the Auto Mode classifier rejects an operation — allows custom handling or logging of denials.
defer decision for PreToolUse in headless: headless sessions can defer permission decisions rather than blocking, enabling partial-autonomy patterns.
Approval Queue Pattern: agent runs, enqueues permission requests rather than blocking; human processes queue asynchronously. 24/7 operation without full YOLO.
Containerized YOLO (github.com/con/yolo): rootless container isolation.

Tier 3 — Managed/cloud (now fully GA):

Claude Code Routines: fully GA, runs on Anthropic’s cloud infrastructure — no local process required. Three trigger types: scheduled (hourly/daily/weekday/weekly, timezone-converted), GitHub events (webhook-triggered on push/PR), API triggers (from your own code). No mid-run approval step — designed for tasks where output is a report, PR, or message. Avoids the permission model entirely by running in managed infrastructure.

Required configuration checklist for unattended operation (each item closes a specific way an unattended run silently stalls or goes unmonitored — none is on by default):

Notification hook (agent_needs_input / agent_completed) — required since subagents run in background by default; without it, a backgrounded subagent’s permission prompt can go unnoticed.
/config idle-timeout opt-in for AskUserQuestion (new — 2026-07-23) — without it, an unattended run that hits an AskUserQuestion dialog hangs indefinitely; there is no default auto-continue as of v2.1.200.
An explicit non-manual permission-mode flag (auto, acceptEdits, dontAsk, or bypassPermissions) — the mode labelled “default”/“Manual” still asks before every action; this has not changed, only its label has (v2.1.200).

Remaining gaps:

Permission model still can’t express “allow writes only in src/ and tests/” as a native CLI flag — Anthropic closed the feature request for this (Issue #35527) as “not planned” (2026-07). The opt-in Sandboxed Bash Tool (/sandbox command, off by default) is the sanctioned alternative, but it doesn’t distinguish cloud-synced storage paths (OneDrive/Google Drive/iCloud) from ordinary local paths — a concrete incident (Issue #35513) shows Explore subagents triggering unwanted OneDrive downloads outside the project scope, even under --dangerously-skip-permissions. The glob-based fallback (Edit(src/**) allow rules) had its own any-depth-matching correctness bug fixed 2026-07-18 (v2.1.214), so it’s more trustworthy now than a month ago, but remains a workaround rather than a first-class profile primitive.
MCP tool approval prompts in the VS Code extension bypass allowlist rules (GitHub Issue #10801).
Routines have no mid-run approval capability by design — tasks requiring any mid-run human decision point can’t use Routines. New (2026-07-27), currently open: a distinct bug (Issue #61015 and duplicates) means even connector-based Routine tasks that should run without any approval step (pre-authorized Anthropic-hosted MCP connectors like Gmail/Workspace) currently hit an unsatisfiable server-side “requires approval” wall and fail outright — worse than the by-design limitation, and worth re-checking for a fix.
New (2026-07-27), refines rather than closes a gap: Claude Code Desktop forces every session into an isolated git worktree with no setting to disable it (Issue #50109, recurring since #21236) — the opposite problem from the CLI, where worktree isolation is opt-in. Not itself a permission-model gap, but relevant context for anyone treating “YOLO + worktrees” as a single, uniformly opt-in pattern across surfaces.
~~Auto Mode not available on Pro, Bedrock, Vertex, or Foundry~~ — resolved 2026-07: GA for all users 2026-07-10; on by default for Bedrock/Vertex/Foundry as of v2.1.207 (2026-07-11); confirmed available on Pro. Anthropic still recommends isolated environments over production/shared-team use as a risk-posture caveat, not an availability restriction.
Audit log gap for unattended sessions: EU AI Act high-risk classification (August 2026 — now imminent) will require immutable audit trails for agentic systems operating in high-impact domains. The current permission model (Auto Mode + hooks) produces decision logs, but no enforcement-grade immutable audit trail. Routines and Managed Agents are closer to satisfying this requirement than local YOLO patterns, but documentation on audit log mechanisms remains sparse — no update found this cycle despite the deadline now being about a week away.
New (2026-07-23): unattended runs can silently stall on AskUserQuestion. Since v2.1.200, an unanswered AskUserQuestion dialog no longer auto-continues by default — it blocks indefinitely unless an idle-timeout has been explicitly configured via /config. This reverses a brief (v2.1.198–v2.1.200) undocumented auto-continue default that was itself rolled back on safety grounds. Net effect for this quest: one more piece of required upfront configuration for genuinely unattended runs, not a regression from a prior working state.

Last updated: 2026-07-23

Note on this revision: this section had grown into a long chronological stack of “Update from Nth cycle” write-ups across twelve gather cycles. As of 2026-07-23 it has been consolidated into a single distilled synthesis; nothing was discarded — the full prior chronological text is preserved verbatim as the “2026-07-23 snapshot” at the top of Synthesis History below.

The current solution landscape:

Tier 1 — Recommended for unattended runs:

Auto Mode with tiers (claude --auto-mode): now offers three granularity levels — permissive (approves most operations, surfaces only high-risk actions), balanced (default; approves safe operations, surfaces ambiguous ones), restrictive (surfaces more actions for human review). The classifier receives action type, target path/command, working directory, and active permission policy; returns approve/deny/escalate in milliseconds. Session backstop: 3 consecutive denials or 20 total triggers escalation to the human.
/loop with Auto Mode: iterates autonomously until the task is complete without per-iteration approval.
YOLO + worktrees: --dangerously-skip-permissions + -w/--worktree. Remains valid as legacy approach; safety via diff review.
Headless mode with --allowedTools: claude -p "task" --allowedTools "Bash,Read,Edit". Tool-level allowlists for scripted/CI runs.

Tier 2 — Supplementary:

Allowlists in settings.json: pre-approve specific command patterns. Note: if a tool is in permissions.allow, the PermissionRequest hook never fires — precedence matters.
PermissionRequest hooks: return {"behavior": "allow"} for conditional auto-approval. More surgical than static allowlists.
PermissionDenied hook (new): fires after the Auto Mode classifier rejects an operation — allows custom handling or logging of denials.
defer decision for PreToolUse in headless: headless sessions can defer permission decisions rather than blocking, enabling partial-autonomy patterns.
Approval Queue Pattern: agent runs, enqueues permission requests rather than blocking; human processes queue asynchronously. 24/7 operation without full YOLO.
Containerized YOLO (github.com/con/yolo): rootless container isolation.

Tier 3 — Managed/cloud (now fully GA):

Claude Code Routines: fully GA, runs on Anthropic’s cloud infrastructure — no local process required. Three trigger types: scheduled (hourly/daily/weekday/weekly, timezone-converted), GitHub events (webhook-triggered on push/PR), API triggers (from your own code). No mid-run approval step — designed for tasks where output is a report, PR, or message. Avoids the permission model entirely by running in managed infrastructure.

Required configuration checklist for unattended operation (each item closes a specific way an unattended run silently stalls or goes unmonitored — none is on by default):

Notification hook (agent_needs_input / agent_completed) — required since subagents run in background by default; without it, a backgrounded subagent’s permission prompt can go unnoticed.
/config idle-timeout opt-in for AskUserQuestion (new — 2026-07-23) — without it, an unattended run that hits an AskUserQuestion dialog hangs indefinitely; there is no default auto-continue as of v2.1.200.
An explicit non-manual permission-mode flag (auto, acceptEdits, dontAsk, or bypassPermissions) — the mode labelled “default”/“Manual” still asks before every action; this has not changed, only its label has (v2.1.200).

Remaining gaps:

Permission model still can’t express “allow writes only in src/ and tests/” as a native CLI flag — Anthropic closed the feature request for this (Issue #35527) as “not planned” (2026-07). The opt-in Sandboxed Bash Tool (/sandbox command, off by default) is the sanctioned alternative, but it doesn’t distinguish cloud-synced storage paths (OneDrive/Google Drive/iCloud) from ordinary local paths — a concrete incident (Issue #35513) shows Explore subagents triggering unwanted OneDrive downloads outside the project scope, even under --dangerously-skip-permissions. The glob-based fallback (Edit(src/**) allow rules) had its own any-depth-matching correctness bug fixed 2026-07-18 (v2.1.214), so it’s more trustworthy now than a month ago, but remains a workaround rather than a first-class profile primitive.
MCP tool approval prompts in the VS Code extension bypass allowlist rules (GitHub Issue #10801).
Routines have no mid-run approval capability — tasks requiring any mid-run human decision point can’t use Routines.
~~Auto Mode not available on Pro, Bedrock, Vertex, or Foundry~~ — resolved 2026-07: GA for all users 2026-07-10; on by default for Bedrock/Vertex/Foundry as of v2.1.207 (2026-07-11); confirmed available on Pro. Anthropic still recommends isolated environments over production/shared-team use as a risk-posture caveat, not an availability restriction.
Audit log gap for unattended sessions: EU AI Act high-risk classification (August 2026) will require immutable audit trails for agentic systems operating in high-impact domains. The current permission model (Auto Mode + hooks) produces decision logs, but no enforcement-grade immutable audit trail. Routines and Managed Agents are closer to satisfying this requirement than local YOLO patterns, but documentation on audit log mechanisms is sparse. A gap that will become compliance-relevant in Q3 2026.
New (2026-07-23): unattended runs can silently stall on AskUserQuestion. Since v2.1.200, an unanswered AskUserQuestion dialog no longer auto-continues by default — it blocks indefinitely unless an idle-timeout has been explicitly configured via /config. This reverses a brief (v2.1.198–v2.1.200) undocumented auto-continue default that was itself rolled back on safety grounds. Net effect for this quest: one more piece of required upfront configuration for genuinely unattended runs, not a regression from a prior working state.

Last updated: 2026-07-18

Update from twelfth gather cycle (2026-07-18): Two updates, one closing a long-tracked gap.

Auto Mode reaches full general availability — Pro, Bedrock, Vertex, and Foundry gap closed (significant). Auto Mode moved from “research preview” (Team plan only) to general availability for all users on 2026-07-10 (claude.com/blog/auto-mode), and Claude Code v2.1.207 (2026-07-11) removed the CLAUDE_CODE_ENABLE_AUTO_MODE opt-in requirement for Bedrock, Vertex AI, and Foundry — Auto Mode is now on by default on managed providers (operators opt out via disableAutoMode). Independent reporting corroborates Auto Mode is also now available on the Pro plan, supporting Sonnet 4.6 and Opus 4.6/4.7. Assessment: significant — this closes the platform-availability gap that has sat on the Remaining Gaps list since the 2026-05-27 cycle (“Auto Mode not available on Pro, Bedrock, Vertex, or Foundry… described as research preview, not recommended for shared team environments”). The Tier 1 recommendation (Auto Mode) is now platform-universal rather than caveated to Team/Enterprise/API. Caveat: Anthropic’s own copy still recommends isolated environments over production systems (“doesn’t eliminate risk entirely”) — GA status changes availability, not the risk profile established by the classifier precision metrics (0.4% benign blocked / ~17% overeager pass-through) captured in the 2026-05-30 cycle.

Anthropic closes the “granular permission profiles” feature request as “not planned” — confirms sandboxing, not scoped permissions, is the sanctioned path forward (incremental, clarifying). GitHub Issue #35527 requested exactly the capability this quest has tracked as its most persistent remaining gap: CLI-level directory-scoped permissions (e.g. claude --permissions=scoped:/src, or named profiles strict/standard/full). Anthropic closed it “not planned” in July 2026, with no roadmap commitment. The linked incident (#35513, also closed not planned) is a concrete manifestation of the gap: Claude Code’s Explore subagent triggered unscoped file access that caused Windows OneDrive (files-on-demand) to download cloud-only placeholder files outside the project directory — occurring even under --dangerously-skip-permissions. Separately, this cycle confirms the CLI-native integration path for the Sandboxed Bash Tool that was flagged as unconfirmed in the 2026-06-26 cycle: it activates via the /sandbox command (not a separate special runtime; macOS uses the built-in Seatbelt framework with no extra install), and is off by default. Assessment: incremental but clarifying — resolves an open question about direction. The CLI will not grow a native scoped-permission flag; the opt-in sandboxed Bash tool remains the only sanctioned route to directory-scoped enforcement, and it does not address cloud-sync storage path leakage (OneDrive/Google Drive/iCloud appearing as ordinary local paths) specifically.

Remaining gaps updated: “Auto Mode not available on Pro, Bedrock, Vertex, or Foundry” — resolved, removed from the list (GA achieved July 2026 across all four). Directory-scoped write permissions gap reframed: Anthropic has explicitly closed the native-flag feature request as not-planned (Issue #35527); the opt-in Sandboxed Bash Tool via /sandbox remains the answer but does not cover cloud-sync storage path leakage — added as a new specific instance of the gap (Issue #35513).

Update from eleventh gather cycle (2026-07-09): Two significant additions.

“Comment and Control” — a second prompt injection attack class, at the platform level (significant). The June 25 PoC demonstrated indirect prompt injection via repository content (files, READMEs, code comments). The July 2026 “Comment and Control” attack class demonstrates a distinct attack surface: GitHub platform events (PR titles, issue bodies, issue comments). Both bypass the Auto Mode classifier — but through different mechanisms. Repository injection: Claude reads malicious content as part of legitimate file analysis. Comment and Control: GitHub Actions workflows auto-trigger on pull_request, issues, and issue_comment events; the AI agent processes the PR title or issue body as authoritative instructions with no sanitisation. No victim interaction required — opening a PR or filing an issue is sufficient to activate the agent. Assessment: significant — this is a second independent confirmation that the Auto Mode classifier cannot defend against injection attacks regardless of which surface the injection uses. The correct mitigation is now broader: repository trust and PR/issue hygiene and workflow scope restriction. The attack surface is the entire GitHub event system, not just untrusted repositories.

Claude Code subagents now background by default — permission implications (incremental). Subagents running in background by default (July 2026 changelog) changes the permission prompt timing: the main Claude loop continues executing while subagents work, meaning permission prompts from subagents may now arrive asynchronously during periods when you’re not actively monitoring. The new Notification hook (agent_needs_input / agent_completed) is the mitigation — it fires when a backgrounded subagent needs input. Without the hook configured, subagent permission prompts may be missed. Assessment: incremental — doesn’t change the permission model, but changes the monitoring model for unattended runs. Notification hook configuration becomes a prerequisite for reliable unattended operation with subagents.

Remaining gaps updated: Adds “GitHub PR/issue injection via platform events (Comment and Control) — no Auto Mode fix; mitigation is workflow scope restriction + actor allowlisting for GitHub Actions.” Notification hook now in the required-configuration list for unattended subagent runs.

Update from tenth gather cycle (2026-07-03): One significant addition.

Indirect prompt injection bypasses Auto Mode without triggering permission prompts (PoC June 25, 2026). A proof-of-concept published June 25 demonstrates that untrusted repository content (files, README, code comments) can inject instructions that cause Claude Code to execute arbitrary shell commands — resulting in a fully interactive shell under the developer’s own user privileges. The attack exploits Claude Code’s agentic file-reading combined with unsandboxed shell execution. Critically: this bypasses Auto Mode’s classifier entirely, because the injection works at the semantic level (Claude follows injected instructions as if they were user intent) rather than the tool-call level (where the classifier operates). The classifier sees a legitimate tool call; the reason for that tool call is the injected instruction, which the classifier never evaluates. Assessment: significant — this is the first documented attack class where Auto Mode provides no defence. The correct mitigation is not a permission mode but a trust boundary: only open repositories you control or have reviewed before opening with Claude Code. The sandboxed bash tool (directory + network isolation) would mitigate this by constraining the blast radius of successful injection; the permission model alone does not. Updates the remaining gaps list: adds “Auto Mode can be bypassed via indirect prompt injection in repository content — no permission-mode fix; mitigation is repository trust and sandbox isolation.”

Update from ninth gather cycle (2026-06-26): Two additions.

/rewind — session-level rollback for tool calls (v2.1.191, June 25, 2026). Claude Code now automatically snapshots all modified files after each response. /rewind restores file state and conversation history to any earlier checkpoint — allowing “fork” restarts from a prior turn. Limitation: cannot undo external effects (npm install, git push, API calls). Assessment: incremental, but meaningfully changes the risk profile of unattended runs. Previously a bad tool call required either accepting the damage or manually reversing it; now the session can recover to a clean state without discarding the entire conversation. Changes the correct mindset for unattended runs from “prevent bad tool calls” to “detect and rewind bad tool calls.”

Sandboxed Bash Tool — directory and network isolation closes the write-scope gap. The Anthropic engineering blog (October 2025) describes a Sandboxed Bash Tool runtime: “let you define exactly which directories and network hosts your agent can access.” Internal testing shows 84% reduction in permission prompts. This is the directory-scoped write permission capability the quest has been tracking as a remaining gap since the seed snapshot. Assessment: significant — the directory-scoped write permissions gap is now at least partially addressable via the sandboxed runtime. Caveat: the sandboxed Bash Tool may require additional configuration beyond the standard Claude Code CLI and may impose performance overhead; practical adoption for general unattended runs is not yet confirmed.

Remaining gaps updated: Directory-scoped write permissions now addressable via Sandboxed Bash Tool (though not the default CLI configuration). Other gaps unchanged: MCP VS Code bypass (GitHub Issue #10801), Routines no mid-run HITL, Auto Mode not on Pro/Bedrock/Vertex/Foundry, audit log gap for EU AI Act high-risk compliance.

Update from eighth gather cycle (2026-06-19): Three incremental additions.

dontAsk mode formally documented. A sixth permission mode now exists: dontAsk auto-denies every tool call that would otherwise prompt, allowing only actions matching permissions.allow rules and read-only Bash commands. This is the CI/locked-down mode — fully non-interactive, no YOLO. Set with --permission-mode dontAsk. Cloud sessions on claude.ai ignore defaultMode: "dontAsk" from settings. Assessment: closes the “headless + allowedTools is the best we have for CI” gap. dontAsk is a cleaner formulation: declare what’s allowed, deny everything else, fully non-interactive.

Auto mode subagent pre-spawn check (v2.1.178+). The classifier now evaluates the delegated task description before a subagent starts — a dangerous-looking task is blocked at spawn time, before it executes. Previous versions only checked during and after execution. Assessment: incremental safety improvement; doesn’t change the permission model structure but closes a window where subagents could be spawned for dangerous tasks before any classifier check ran.

Auto mode conversational boundaries enforced by classifier. Statements you make in conversation (“don’t push”, “wait until I review before deploying”) are now treated as block signals by the classifier — matching actions are blocked even when default rules would allow them. The boundary persists until explicitly lifted. Caveat: boundaries can be lost if context compaction removes the message that stated them; use deny rules for hard guarantees. Assessment: incremental; useful for unattended runs where you want to constrain scope without editing settings.

Auto mode repository self-grant blocked (v2.1.142+). .claude/settings.json (project-level) can no longer set defaultMode: "auto" — Claude Code ignores it from those files to prevent a repository from granting itself auto mode. Must be set in ~/.claude/settings.json. Assessment: security hardening; no change to individual developer workflow.

Update from seventh gather cycle (2026-06-11): Two incremental platform changes: (1) Fable 5 is now the default model in Claude Code — all unattended runs default to the higher-capability model; the permission architecture is unchanged, but the model routing means higher-quality outputs for the same permission configuration; (2) Rate limits doubled — the API-call ceiling that previously constrained large Dynamic Workflows runs has been raised; for unattended runs at scale (100+ subagents), the practical throughput limit is now higher. Neither change alters the fundamental permission model; both improve the unattended-run experience at the edges.

The core answer remains Auto Mode + allowlists + hooks, with one structural addition: Dynamic Workflows introduces a new permission context for large-scale agentic runs that changes the question for users wanting to run 100+ concurrent tasks.

New: Dynamic Workflows permission model (2026-05-28)

Dynamic Workflows subagents run in acceptEdits mode — file edits are automatically approved without per-edit permission prompts. Shell commands and web fetches can still trigger approval prompts mid-run. In headless mode or via the Agent SDK (no interactive user), all tool calls follow configured permission rules without confirmation. The orchestration script itself (the JavaScript file Claude writes) inherits the user’s tool allowlist.

Practical implication: for use cases involving large-scale file modification (codebase audits, migrations, security hardening), Dynamic Workflows bypasses the permission model friction for file operations while retaining it for shell commands. This is the closest thing yet to “pre-approve the task plan, then run uninterrupted” — the ideal the quest seed snapshot identified as the missing capability.

v2.1.160 security tightening (2026-06-02)

acceptEdits mode now prompts before writing to shell startup files (.zshenv, .zlogin, .bash_login) and build-tool config files that grant code execution. This incrementally closes the surface where acceptEdits mode could be exploited — previously those files were auto-approved; now they require an explicit confirmation even in acceptEdits mode.

The current solution landscape:

Tier 1 — Recommended for unattended runs:

Auto Mode with tiers (claude --auto-mode): now offers three granularity levels — permissive (approves most operations, surfaces only high-risk actions), balanced (default; approves safe operations, surfaces ambiguous ones), restrictive (surfaces more actions for human review). The classifier receives action type, target path/command, working directory, and active permission policy; returns approve/deny/escalate in milliseconds. Session backstop: 3 consecutive denials or 20 total triggers escalation to the human.
/loop with Auto Mode: iterates autonomously until the task is complete without per-iteration approval.
YOLO + worktrees: --dangerously-skip-permissions + -w/--worktree. Remains valid as legacy approach; safety via diff review.
Headless mode with --allowedTools: claude -p "task" --allowedTools "Bash,Read,Edit". Tool-level allowlists for scripted/CI runs.

Tier 2 — Supplementary:

Allowlists in settings.json: pre-approve specific command patterns. Note: if a tool is in permissions.allow, the PermissionRequest hook never fires — precedence matters.
PermissionRequest hooks: return {"behavior": "allow"} for conditional auto-approval. More surgical than static allowlists.
PermissionDenied hook (new): fires after the Auto Mode classifier rejects an operation — allows custom handling or logging of denials.
defer decision for PreToolUse in headless: headless sessions can defer permission decisions rather than blocking, enabling partial-autonomy patterns.
Approval Queue Pattern: agent runs, enqueues permission requests rather than blocking; human processes queue asynchronously. 24/7 operation without full YOLO.
Containerized YOLO (github.com/con/yolo): rootless container isolation.

Tier 3 — Managed/cloud (now fully GA):

Claude Code Routines: fully GA, runs on Anthropic’s cloud infrastructure — no local process required. Three trigger types: scheduled (hourly/daily/weekday/weekly, timezone-converted), GitHub events (webhook-triggered on push/PR), API triggers (from your own code). No mid-run approval step — designed for tasks where output is a report, PR, or message. Avoids the permission model entirely by running in managed infrastructure.

Remaining gaps:

Permission model still can’t express “allow writes only in src/ and tests/” as a native CLI flag — Anthropic closed the feature request for this (Issue #35527) as “not planned” (2026-07). The opt-in Sandboxed Bash Tool (/sandbox command, off by default) is the sanctioned alternative, but it doesn’t distinguish cloud-synced storage paths (OneDrive/Google Drive/iCloud) from ordinary local paths — a concrete incident (Issue #35513) shows Explore subagents triggering unwanted OneDrive downloads outside the project scope, even under --dangerously-skip-permissions.
MCP tool approval prompts in the VS Code extension bypass allowlist rules (GitHub Issue #10801).
Routines have no mid-run approval capability — tasks requiring any mid-run human decision point can’t use Routines.
~~Auto Mode not available on Pro, Bedrock, Vertex, or Foundry~~ — resolved 2026-07: GA for all users 2026-07-10; on by default for Bedrock/Vertex/Foundry as of v2.1.207 (2026-07-11); confirmed available on Pro. Anthropic still recommends isolated environments over production/shared-team use as a risk-posture caveat, not an availability restriction.
Audit log gap for unattended sessions: EU AI Act high-risk classification (August 2026) will require immutable audit trails for agentic systems operating in high-impact domains. The current permission model (Auto Mode + hooks) produces decision logs, but no enforcement-grade immutable audit trail. Routines and Managed Agents are closer to satisfying this requirement than local YOLO patterns, but documentation on audit log mechanisms is sparse. A gap that will become compliance-relevant in Q3 2026.

Core answer: Auto Mode (3 tiers: permissive/balanced/restrictive) + allowlists + hooks + Routines + Dynamic Workflows — Auto Mode still described as “research preview,” not yet available on Pro/Bedrock/Vertex/Foundry. Most recent structural findings were two independent confirmations that indirect prompt injection bypasses the Auto Mode classifier entirely — via untrusted repository content (June 25 PoC) and via GitHub platform events / PR-issue text (“Comment and Control,” July 2026) — establishing that the classifier’s tool-call-level operation cannot defend against semantic-level attacks regardless of injection surface; mitigation sits outside the permission model (repository trust, workflow scope restriction, sandbox isolation). Subagents running in background by default changed the monitoring model, making the Notification hook a prerequisite for reliable unattended operation. Remaining gaps: no directory-scoped write permissions (partially addressed by opt-in Sandboxed Bash Tool, CLI integration path unconfirmed); MCP VS Code bypass; Routines no mid-run HITL; Auto Mode platform restrictions (Pro/Bedrock/Vertex/Foundry); EU AI Act audit log gap.

Core answer unchanged structurally. Two new attack classes both confirm the same architectural gap: Auto Mode classifier operates at the tool-call level and cannot defend against semantic-level injection regardless of which surface the injection uses. Attack surface now confirmed as: repository content (June 25 PoC) + GitHub platform events (Comment and Control, July 2026). Subagents-background-by-default changes monitoring model for unattended runs — Notification hook now a required-configuration item. No new structural permission model improvements this cycle.

Core answer unchanged: Auto Mode (3 tiers) + allowlists + hooks + Routines + Dynamic Workflows. One significant new caveat: indirect prompt injection via untrusted repository content bypasses Auto Mode entirely (PoC June 25). The classifier operates at the tool-call level; injection works at the semantic level — an architectural gap no permission mode can close. Mitigation: sandbox isolation + repository trust vetting (outside the permission model). New remaining gap added to the list.

/rewind (v2.1.191) adds session-level rollback — changes the risk management mindset from “prevent bad tool calls” to “detect and rewind bad tool calls.” Sandboxed Bash Tool (October 2025, newly captured) addresses the directory-scoped write permissions gap that has been in the remaining gaps list since the seed snapshot. Core Tier 1 recommendation (Auto Mode + allowlists + hooks + Routines + Dynamic Workflows) unchanged.

Core answer expanded to six permission modes. dontAsk closes the CI non-interactive gap. Auto mode subagent pre-spawn check and conversational boundary enforcement are incremental safety additions. No structural change to the Tier 1 recommendation (Auto Mode + allowlists + hooks + Routines + Dynamic Workflows). Remaining gaps unchanged.

Core answer unchanged: Auto Mode (3 tiers) + allowlists + hooks + Routines + Dynamic Workflows. Two incremental improvements: Fable 5 as new default (higher quality for same permissions); rate limits doubled (higher throughput for large Dynamic Workflows runs). No structural changes to the permission model.

Core answer: Auto Mode (3 tiers) + allowlists + hooks + Routines, now with Dynamic Workflows as a new Tier 1 option for large-scale file-modification tasks. Dynamic Workflows subagents run in acceptEdits mode (file edits auto-approved, shell commands/web fetches can still prompt) — closest yet to the “pre-approve task plan” ideal from seed snapshot. v2.1.160 incrementally tightens acceptEdits mode for shell startup files and build-tool configs. Remaining gaps unchanged.

Core answer unchanged. Minor update: Anthropic engineering blog now discloses concrete precision metrics — ~0.4% benign commands blocked (low false-positive); ~17% overeager actions pass through (non-trivial false-negative). This confirms Auto Mode is defence-in-depth, not a standalone safety control — worktree/container isolation remains required for high-stakes unattended runs.

Core answer: Auto Mode (3 tiers) + allowlists + hooks + Routines. Auto Mode: permissive/balanced/restrictive; backstop 3/20 denials; Tier 1 for unattended. Routines: fully GA, 3 trigger types, no mid-run approval. Remaining gaps: directory-scoped write permissions don’t exist; MCP VS Code bypass; Routines no mid-run HITL; Auto Mode not on Pro/Bedrock/Vertex/Foundry. Agent SDK is a separate permission surface.

Core answer: Auto Mode + allowlists + hooks. New additions: /loop (iterate until complete) and /schedule (deferred execution) as built-in autonomous primitives; Approval Queue Pattern as 24/7 middle-ground architecture. Tier 3: Claude Code Routines (managed cloud, then described as not fully GA). Remaining gaps: no directory-scoped write permissions; MCP VS Code bypass; YOLO data loss risk confirmed by Willison.

The landscape has changed materially since the seed answer. Anthropic shipped Auto Mode on 2026-03-24 — a Sonnet 4.6-based safety classifier that evaluates every tool call before execution, replacing per-action prompts with ML-based sandboxing. Boris Cherny (Claude Code creator) explicitly positioned it as the replacement for --dangerously-skip-permissions. Auto Mode blocks mass deletion, data exfiltration, and prompt-injection-driven escalation while allowing safe actions uninterrupted. This is the product-level solution we were watching for.

Tier 1: Auto Mode, YOLO + worktrees, --allowedTools. Tier 2: settings.json allowlists, PermissionRequest hooks, containerized YOLO. Tier 3: Claude Code Routines.

Remaining gaps: directory-scoped write permissions still don’t exist; MCP VS Code bypass issue open; .git/ and .claude/ protected since v2.1.78; data loss risk confirmed by Willison.

The cleanest current approach is YOLO + worktrees: run Claude Code with --dangerously-skip-permissions inside an isolated git worktree (separate branch), and review the diff before merging. This replaces per-action approval with post-run diff review — architecturally cleaner because safety is provided by branch isolation, not by per-command prompting. The worktree can be discarded if the output is wrong.

For finer-grained control without full YOLO, allowlists in settings.json are the right tool. Specific command patterns can be pre-approved so common operations (reading files, running tests, grep) don’t interrupt the run. The fewer-permission-prompts skill automates building these allowlists from transcript history — it analyses past sessions to identify which tools you approved most often.

Other approaches in the solution space:

--dangerously-skip-permissions alone (without worktrees): removes all safety, no isolation
Hooks for auto-approval: surgical, but requires upfront configuration per pattern
Task decomposition: smaller chunks = smaller approval surface, but doesn’t eliminate it

What the answer doesn’t yet have: a product-level permission model that allows “pre-approve this task plan” without either YOLO or per-command configuration. That would be the ideal: front-load approval to a single plan review, then run uninterrupted.

Open thread: Anthropic’s product roadmap for permission model granularity is the key thing to watch. Orchestration frameworks (Managed Agents API) that front-load approvals would also change the answer materially.

Evidence (new — 2026-07-29) #

2026-07-29 — Hijacking Claude Code via Injected Marketplace Plugins — PromptArmor #

Type: contradictory A malicious plugin distributed through Claude Code’s plugin-marketplace ecosystem (e.g. discoverable via a registry like claudecodemarketplaces.com, which scrapes GitHub hourly) installs a hook that rewrites the user’s own permission settings — either permanently allowlisting a dangerous command (curl) or auto-approving specific command types via a PreToolUse-style hook. A subsequent prompt-injection payload then triggers exfiltration of codebase contents to an attacker’s server with zero approval prompt, because the hook already disabled the prompt before the exfiltrating command ran. Newly surfaced to this quest’s evidence, though the underlying research predates this quest’s first cycle. Assessment: contradictory and structurally novel — this is a third documented way to bypass unattended-run safety, but unlike repository-content injection and “Comment and Control” (both of which evade the classifier by staying below its semantic radar), this one bypasses the entire permission system by having attacker-supplied code rewrite it directly, weaponizing hooks — the exact mechanism this quest recommends in Tier 2 as “more surgical than static allowlists.” Anthropic’s sanctioned mitigation (allowManagedHooksOnly, strictKnownMarketplaces) sits at the admin/managed-settings layer, leaving solo developers and small teams without an equivalent backstop.

2026-07-29 — Claude Code Settings, Permissions, and Bash Tool Security — General Analysis #

Type: supporting Documents the specific managed-settings controls that mitigate the marketplace-plugin-hook attack above: allowManagedHooksOnly prevents loading of user, project, and plugin hooks, only allowing managed and SDK hooks (hooks from plugins the organisation force-enables via enabledPlugins are exempt, so admins can still distribute vetted hooks through an org marketplace); strictKnownMarketplaces restricts which plugin marketplaces can be installed from at all; hook allowlists (allowedHttpHookUrls) apply across every settings source. Assessment: supporting — confirms the sanctioned mitigation path is entirely at the admin-enforced layer, with no individual-developer-level equivalent; this is the concrete configuration this quest should point to when the hooks-as-attack-surface caveat applies to a team context.

2026-07-29 — EU AI Act Digital Omnibus — high-risk deadline deferred to December 2027 #

Type: contradictory The EU’s “Digital Omnibus on AI” — following European Parliament endorsement (16 June 2026) and Council green light (29 June 2026) — entered into force 2026-07-27, deferring the AI Act’s high-risk-system compliance deadline for stand-alone Annex III systems from 2026-08-02 to 2027-12-02 (Annex I systems embedded in regulated products: deferred to 2028-08). Corroborated independently by Gibson Dunn’s and other legal-analysis coverage. Three narrower obligations (Article 50 AI-generated-content transparency, GPAI penalty enforcement, national market-surveillance authority) still take effect on the original 2026-08-02 date. Assessment: contradictory to this quest’s own framing — directly resolves the “imminent… about a week away” urgency this quest has attached to the “audit log gap for unattended sessions” remaining-gap item since the 2026-05-27 cycle. The underlying technical gap (no enforcement-grade immutable audit trail from Auto Mode + hooks) is unchanged, but the compliance clock forcing near-term action on it has been reset by roughly 16 months.

2026-07-29 — Boris Cherny — five tips for running Opus autonomously for hours/days #

Type: contextual Watched-author post (cross-posted to Threads): “1. Use auto mode for permissions, so Claude doesn’t ask for approval 2. Use dynamic workflows, to have Claude orchestrate hundreds/thousands of agents to get a task done 3. Use /goal or /loop, to nudge Claude to keep going until it’s done 4. Use Claude Code in the cloud, so you can close your laptop… 5. Make sure Claude has a way to self-verify its work end to end.” Assessment: contextual — reaffirms the existing Tier 1 stack from the product’s own lead, adding no new capability, but surfaces /goal as a distinct autonomous-nudge primitive this quest had not previously tracked (independently confirmed via documentation as a goal-directed plan/execute/observe/iterate loop with an explicit success condition, differentiated from /loop’s “iterate until complete” framing).

2026-07-29 — I stopped approving Claude Code’s commands after discovering its built-in sandbox — XDA Developers #

Type: supporting Practitioner account of adopting /sandbox with auto-allow mode, corroborating the previously-cited 84% permission-prompt-reduction figure with lived experience. Adds one platform detail not previously captured in this quest’s evidence: the sandbox uses macOS’s built-in Seatbelt framework on Mac, but Bubblewrap on Linux and WSL2 — this quest’s evidence had only documented the macOS mechanism. Assessment: supporting, minor — real-world validation that sandbox + auto-allow removes the need to babysit approvals for routine work, plus a small factual addition (cross-platform sandbox backend).

Evidence (new — 2026-07-27) #

2026-07-27 — Claude Code Release v2.1.219 #

Type: supporting Two permission-relevant fixes in the same release (2026-07-24): (1) “Always allow” permission rules now save at the repository root rather than per-worktree-session, so an approval granted in one git worktree persists across sessions and other worktrees of the same repo — previously each worktree accumulated its own separate, resettable approval state. (2) New sandbox.network.strictAllowlist setting: sandboxed commands connecting to a non-allowlisted host are now denied outright rather than falling through to a prompt — tightens the Sandboxed Bash Tool’s network-isolation boundary (tracked as the sanctioned scoping mechanism since 2026-06-26). Assessment: supporting — both are incremental quality-of-life fixes to the already-recommended stack (allowlists + worktrees + sandbox), not new capabilities, but they specifically close two friction sources this quest has repeatedly flagged: per-worktree re-approval friction in the “multi-clauding” pattern, and the sandbox’s previously coarse network boundary.

2026-07-27 — Auto mode for Claude Code — Simon Willison #

Type: supporting Watched-author critique published alongside Auto Mode’s original March 2026 launch, not previously captured in this quest’s evidence. Willison flags a specific, concrete gap in Auto Mode’s default allowlist: manifest-based installs (pip install -r requirements.txt, npm install) are auto-approved provided the agent hasn’t edited the manifest itself, but this doesn’t cover agent-chosen ad hoc package installs (pip install foo, carrying typosquat risk), and even the manifest path offers no protection against unpinned-dependency supply-chain attacks. His broader framing: AI-classifier-based protections are “non-deterministic by nature,” fundamentally different from OS-level sandboxing that deterministically restricts file/network access — he trusts the latter “a whole lot more.” Assessment: supporting — sharpens, with a specific named example, the “classifier has a real ceiling” point already in the synthesis (0.4%/17% precision stats); independently corroborates from the quest’s most-watched author that the correct posture is sandbox isolation as the deterministic backstop, not the classifier alone.

2026-07-27 — Routines: MCP connector tool calls fail with “requires approval” (Issue #61015 and duplicate cluster #61027/#61044/#61097/#61143) #

Type: contradictory A currently-active bug cluster (multiple independent reports, all closed as duplicates of #61015): MCP connector tool calls within Routines — including Anthropic-hosted connectors like Gmail/Workspace — unexpectedly return “requires approval” at the server level, before Claude Code’s own permission logic is even reached, despite the connector having been authorized in claude.ai settings and the UI confirming no approval should be needed. Because Routines run unattended with no interactive channel, there is no way to satisfy the prompt — the routine simply fails. Custom remote MCP server tools are reportedly unaffected; only Anthropic-hosted connectors trigger it. Assessment: contradictory — directly undercuts this quest’s characterisation of Routines as designed to “avoid the permission model entirely.” For connector-based tasks specifically, Routines currently hit an unexpected, unsatisfiable approval wall rather than running uninterrupted. Appears to be a regression/bug rather than an intentional design gap (unlike the already-tracked “no mid-run approval capability” limitation, which is by design); worth re-checking next cycle for a fix.

2026-07-27 — Option to disable automatic worktree isolation in Claude Code Desktop (Issue #50109) #

Type: contextual Claude Code Desktop (a distinct surface from the CLI) creates a new git worktree under <repo>/.claude/worktrees/<n>/ for every session and always runs inside it — there is no setting to run directly in the checked-out working directory instead, unlike the CLI (where worktree isolation is opt-in via -w/--worktree) and the VS Code extension (which doesn’t force it). This is a long-recurring request (near-identical issues #21236, #31896, #33338, #39563, #42234, #49065 precede #50109), still unresolved as of this cycle. Assessment: contextual — refines rather than changes the “YOLO + worktrees” framing: worktree isolation is not purely an opt-in legacy fallback the operator chooses to layer on; on at least one first-party surface (Desktop) it is the mandatory, non-optional default, with users actively requesting an escape hatch rather than more isolation.

Evidence (new — 2026-07-23) #

2026-07-23 — Claude Code v2.1.200 Release Notes #

Type: contextual Primary source (2026-07-03) for two changes conflated by secondary reporting. (1) “Changed the ‘default’ permission mode to ‘Manual’ across the CLI, --help, VS Code, and JetBrains; --permission-mode manual and defaultMode: 'manual' are accepted alongside default” — a backward-compatible rename/label change, not a functional default-behaviour change; the mode still asks before every action, as it always has. (2) “Changed AskUserQuestion dialogs to no longer auto-continue by default; opt into an idle timeout via /config” — this reverses the undocumented AFK auto-continue shipped in v2.1.198 (see next entry). Assessment: contextual but important for accuracy — multiple secondary blogs (techtimes.com, chatforest.com, cjonsystems.substack.com) describe this release as Claude Code “flipping the default from allow to Manual” and a breaking change for unattended pipelines; the primary source does not support that characterisation. Worth flagging as a caution about secondary-source reliability in this space going forward.

2026-07-23 — Claude Code’s 60s AskUserQuestion auto-continue and why it broke interactive safety #

Type: supporting v2.1.198 (early July 2026) quietly shipped an undocumented default: unanswered AskUserQuestion dialogs auto-continued after 60 seconds (CLAUDE_AFK_TIMEOUT_MS), injecting a synthetic “no response” and letting the agent proceed using its own judgment — including past what was meant to be a blocking approval gate before committing or opening a PR. This drew heavy safety criticism (one GitHub report drew 387 reactions, 143 comments) and was rolled back to an opt-in, documented /config setting in v2.1.200. Assessment: supporting — adds a concrete new item to the “required configuration for unattended operation” checklist, parallel to the Notification hook: an unattended run that reaches an AskUserQuestion dialog now hangs indefinitely unless the idle timeout is explicitly configured. Also illustrates Anthropic actively re-tightening a default that had drifted toward more autonomy without adequate safety review.

2026-07-23 — Claude Code Changelog — v2.1.214, v2.1.216, v2.1.218 #

Type: supporting Cluster of permission-check hardening fixes landed 2026-07-18 to 2026-07-22: Bash file-descriptor-redirect forms, zsh variable subscripts/modifiers in [[ ]], PowerShell 5.1 sessions, commands over 10,000 characters, and certain help/man invocations previously slipped past the permission analyzer and ran without prompting — all now correctly prompt or deny. Separately, v2.1.214 fixed single-segment dir/** allow rules (e.g. Edit(src/**)) that were incorrectly auto-approving writes to any nested dir/ anywhere in the tree instead of only <cwd>/dir — tightening the glob-based mechanism that remains the best available (non-native-profile) directory-scoping tool. v2.1.216 also added sandbox.filesystem.disabled (skip filesystem isolation while keeping network egress control). Assessment: supporting — continued, routine hardening of the allowlist-parsing layer that unattended runs depend on; the dir/** fix specifically improves confidence in the glob-based fallback for the still-unresolved directory-scoped-permissions gap.

2026-07-23 — Claude Code v2.1.216 Release Notes #

Type: supporting Fixed a quadratic-cost bug in conversation-history normalization (a step run before every API call): cost scaled as O(n²) with turn count, so a 50-turn Auto Mode session cost roughly 2,500x a 10-turn session; normalization is now a linear scan. Assessment: supporting, and specifically relevant to this quest’s “long task lists” framing — this was a genuine practical barrier to sustained unattended Auto Mode sessions (cost/latency, not permissions), and it disproportionately penalized exactly the users this quest is about: those running the longest, most autonomous sessions.

Evidence (new — 2026-07-18) #

2026-07-18 — Auto mode for Claude Code #

Type: supporting Anthropic’s canonical GA announcement: Auto Mode reached general availability for all users on 2026-07-10, moving from “research preview” (Team plan only) to availability across Pro, Team, and Enterprise. Supports Claude Sonnet 4.6 and Opus 4.6/4.7. Anthropic’s own copy still recommends isolated environments over production systems — GA reduces but doesn’t eliminate risk. Assessment: closes the platform-availability item on the Remaining Gaps list, tracked since the 2026-05-27 cycle.

2026-07-18 — Claude Code v2.1.207: Auto Mode Is Now Default on Bedrock, Vertex AI, and Foundry #

Type: supporting v2.1.207 (2026-07-11) removes the CLAUDE_CODE_ENABLE_AUTO_MODE opt-in requirement — Auto Mode is now on by default for Bedrock, Vertex AI, and Foundry sessions; operators must explicitly set disableAutoMode to restore the prior off-by-default behaviour. Confirms the last three managed-provider gaps in the platform-availability list are closed.

2026-07-18 — Feature Request: Granular permission profiles for Claude Code (Issue #35527) #

Type: contradictory Direct feature request for the capability this quest has tracked as its most persistent remaining gap — CLI-level directory-scoped permissions (--permissions=scoped:/src, named profiles). Closed “not planned” by Anthropic in July 2026, with no roadmap commitment. Confirms Anthropic’s chosen path for scoped enforcement is the sandboxed Bash tool, not a native permission-profile flag.

2026-07-18 — Unscoped file access in Claude Code Explore agent triggers OneDrive downloads (Issue #35513) #

Type: contradictory Concrete incident referenced by #35527: Explore subagents accessed paths outside the scoped repository, and on Windows with OneDrive files-on-demand enabled this triggered downloads of unrelated cloud-only files — occurring even under --dangerously-skip-permissions. Closed “not planned.” Demonstrates that cloud-synced storage paths (OneDrive/Google Drive/iCloud) are not distinguished from ordinary local paths by any current scoping mechanism.

2026-07-18 — Configure the sandboxed Bash tool — Claude Code Docs #

Type: supporting Confirms the CLI-native integration path for the Sandboxed Bash Tool flagged as unconfirmed in the 2026-06-26 cycle: activated via the /sandbox command (not a separate runtime); macOS uses the built-in Seatbelt framework with no extra install. Default sandbox boundaries: only the working directory, its subdirectories, and session temp are writable; most of the filesystem remains readable (including ~/.aws/credentials and ~/.ssh/ by default) unless explicitly denied. Off by default — must be explicitly enabled per session or project.

2026-07-18 — Boris Cherny on Auto Mode and “multi-clauding” #

Type: contextual Boris Cherny (Claude Code creator/lead) states Auto Mode is now his #1 tip and “the key building block for multi-clauding” — running multiple parallel Claude Code sessions (paired with worktrees and subagents) since none of them block on permission prompts. Confirms Anthropic’s internal framing of Auto Mode as the parallel-unattended-run enabler, consistent with this quest’s Tier 1 recommendation.

Evidence (new — 2026-07-09) #

2026-07-09 — Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments #

Type: contradictory “Comment and Control” attack: malicious PR titles, issue bodies, or issue comments inject instructions into AI coding agents. Proactive (not reactive) — GitHub Actions auto-triggers on events; victim interaction not required. Claude Code: PR title directly interpolated into prompt with zero sanitisation. Anthropic classified Critical (CVSS 9.4), implemented some mitigations, $100 bug bounty. Attack surface is the entire GitHub event system — distinct from repository-content injection (June 25 PoC) which required the victim to open an untrusted repo. Assessment: significant — second independent confirmation that the Auto Mode classifier cannot defend against semantic-level injection. The attack surface is now two distinct vectors: repository content (agentic file reading) and platform events (GitHub Actions triggers).

2026-07-09 — Comment and Control: Prompt Injection to Credential Theft in Claude Code, Gemini CLI, and GitHub Copilot Agent #

Type: contradictory Full research write-up by Aonan Guan. Attack runs entirely within GitHub — no external server required. Cross-vendor simultaneous exposure: three tools share the same trust model for GitHub context despite being from different vendors. This is a consequence of independent convergence on the same platform trust assumption, not a shared codebase vulnerability. Enterprise implication: attack surface scales with number of AI coding agents deployed (multiple vendors × shared platform = multi-agent simultaneous exposure).

2026-07-09 — Claude Code changelog — July 2026 #

Type: supporting Subagents now run in background by default (July 2026). New Notification hook (agent_needs_input / agent_completed) fires when backgrounded subagents need input or finish. For unattended runs: without Notification hook configured, subagent permission prompts may be missed as the main loop continues. Hook configuration is now a prerequisite for reliable unattended operation with subagents.

Evidence (new — 2026-07-03) #

2026-07-03 — Researchers Demo New Claude Code Attack Using Harmless-Looking Repositories to Hijack Developer Machines #

Type: contradictory PoC published June 25, 2026. Indirect prompt injection via untrusted repository content — files, README, code comments — can instruct Claude Code to execute arbitrary shell commands, resulting in an interactive shell with full developer privileges and access to all environment secrets. The attack operates at the semantic level (Claude follows injected instructions); the Auto Mode classifier operates at the tool-call level (Claude Code’s tool calls look legitimate because they are — from Claude’s perspective). No permission mode prevents this. Assessment: significant — the first documented attack that bypasses the permission model entirely. The correct mitigation (sandbox isolation + repository trust vetting) is outside the permission model.

2026-07-03 — How we built Claude Code auto mode: a safer way to skip permissions #

Type: supporting Anthropic’s canonical auto mode engineering blog: the classifier sees only the user request and the tool call — deliberately not the prose from the main model, to prevent the model from talking the harness into approving risky actions. Three permission tiers: permissive, balanced, restrictive. Session backstop: 3 consecutive denials or 20 total triggers escalate to human. Assessment: important — the deliberate exclusion of main-model prose is the design feature that makes prompt injection effective against Auto Mode. The classifier is designed to ignore model reasoning, which is also the reasoning injected via prompt injection.

Evidence #

2026-06-26 — Claude Code Checkpointing & /rewind: Roll Back Changes #

Type: supporting Claude Code v2.1.191 (June 25, 2026) adds /rewind — automatic file snapshots after each turn, with restore capability to any prior checkpoint. Restores file state and conversation history; allows forking the session from any prior turn. Limitation: can’t undo external effects (npm install, remote pushes, API calls). Assessment: incremental improvement to unattended run safety. Reframes the correct approach from “prevent bad tool calls” to “detect and rewind bad tool calls.” Does not change the permission model architecture but meaningfully lowers the recovery cost of a bad tool call.

2026-06-26 — Making Claude Code more secure and autonomous with sandboxing #

Type: supporting Anthropic engineering blog (October 2025): Sandboxed Bash Tool runtime defines exactly which directories and network hosts Claude can access — filesystem and network isolation. Internal testing: 84% reduction in permission prompts. This is the first Anthropic-native mechanism that addresses the directory-scoped write permissions gap tracked as “remaining” since the seed snapshot. Caveat: appears to require explicit configuration beyond the standard CLI; not the default for typical unattended runs. Assessment: significant if widely adopted — closes the most persistent remaining gap. Needs confirmation of CLI integration path.

2026-06-19 — Choose a permission mode — Claude Code Docs #

Type: supporting Six permission modes now formally documented: default, acceptEdits, plan, auto, dontAsk, bypassPermissions. dontAsk is the new CI-safe mode: auto-denies everything except permissions.allow rules and read-only Bash commands; fully non-interactive. Auto mode now blocks subagents at task-description evaluation time (v2.1.178+), in addition to during and after execution. Auto mode project-settings self-grant blocked in v2.1.142+. Conversational boundaries (“don’t push”) enforced by classifier. Assessment: incremental — dontAsk is the most significant addition; closes the CI headless-run gap with a properly named, properly-behaved non-interactive mode.

2026-06-02 — Introducing dynamic workflows in Claude Code #

Type: significant Dynamic Workflows subagents run in acceptEdits mode: file edits are auto-approved; shell commands and web fetches can still prompt mid-run. In headless/API mode all tool calls follow configured permission rules without interactive confirmation. The human’s permission interaction is limited to launching the workflow — subagents then execute in the background without per-operation approval for file operations. This is the first production Anthropic tool that implements the “pre-approve the task plan, run uninterrupted” model the quest seed snapshot identified as the missing capability. Assessment: significant — changes the answer for the specific use case of large-scale file-modification runs. Does not resolve the remaining gaps (directory-scoped write permissions, MCP VS Code bypass, Routines no mid-run HITL).

2026-06-02 — Claude Code Changelog v2.1.160 #

Type: supporting acceptEdits mode now prompts before writing to shell startup files (.zshenv, .zlogin, .bash_login) and build-tool config files that grant code execution. This incrementally closes the most dangerous auto-approval surface in acceptEdits mode. Also: Edit no longer requires a separate Read after single-file grep — the grep satisfies the read-before-edit check. Assessment: incremental tightening; does not change the overall permission architecture but reduces the risk profile of acceptEdits mode.

2026-05-22 — Claude Code Routines: Anthropic’s Answer to Unattended Dev Automation #

Type: supporting Routines confirmed fully GA. Runs on Anthropic’s cloud infrastructure — no local machine required. Three trigger types: scheduled (recurring cadence), GitHub events (webhook on push/PR), API triggers (programmatic invocation). No mid-run approval capability by design — suited for tasks with a clear output (report, PR, message). Resolves the local machine constraint that previously limited Tier 3. Significant update: Routines move from “signals direction” to “real solution” for the use case of unattended overnight or scheduled autonomous runs.

2026-05-22 — Automate workflows with hooks — Claude Code Docs #

Type: supporting Documents the PermissionDenied hook (fires after Auto Mode classifier rejects an operation) and the defer decision for PreToolUse in headless sessions. PermissionDenied enables custom handling of Auto Mode rejections — logging, alternative action suggestion, or escalation routing. The defer decision allows headless sessions to continue on non-blocked operations while queuing others, enabling partial-autonomy patterns without a full Approval Queue infrastructure.

2026-05-22 — Claude Code Auto Mode: Autonomous Permission Guide #

Type: supporting Documents the three Auto Mode tiers (permissive/balanced/restrictive) with the specific classifier inputs: action type, target path/command, working directory, active permission policy. Backstop mechanism: 3 consecutive denials or 20 total denials triggers escalation to the human. Adds material nuance to what was previously described as binary (on/off).

2026-05-22 — Configure permissions — Claude Agent SDK Docs #

Type: contextual Agent SDK has a separate permission configuration from the Claude Code CLI. Relevant for programmatic agent pipelines that don’t go through the Claude Code terminal interface. A new surface in the permission model landscape that wasn’t present in earlier cycles.

2026-05-14 — Run Claude Code 24/7 With an Approval Queue Pattern #

Type: supporting Documents the Approval Queue Pattern: Claude runs autonomously, enqueues permission requests rather than blocking, and a human (or automated reviewer) processes the queue asynchronously. Enables genuine 24/7 operation without full YOLO risk — the agent continues on non-blocked operations while the queue accumulates. A meaningful architectural middle-ground not previously documented.

2026-05-14 — Claude Code Autonomous Mode: Guide to –dangerously-skip-permissions, /loop and /schedule #

Type: supporting Documents /loop (instruct Claude to iterate until task complete) and /schedule (schedule future execution) as new built-in primitives for autonomous operation. Combined with Auto Mode, /loop enables sustained unattended execution without per-iteration approval prompts. /schedule enables deferred execution without a human present at invocation time.

2026-05-14 — Inside Claude Code Auto Mode: Anthropic’s Autonomous Coding System with Human Approval Gates #

Type: contextual InfoQ analysis of Auto Mode’s two-stage classification architecture: Stage 1 is a fast initial filter (low latency, handles the majority of tool calls immediately); Stage 2 is deeper analysis for ambiguous cases only. Design goal: security posture comparable to careful manual review at a fraction of the latency. Confirms .claudeignore as the primary trust-boundary definition mechanism.

2026-05-12 — Claude Code Auto Mode: A Safer Way to Run Without Permission Prompts #

Type: supporting Anthropic’s official announcement of Auto Mode (2026-03-24). Sonnet 4.6-based safety classifier evaluates each tool call before execution — blocks mass deletion, data exfiltration, prompt-injection escalation; allows safe actions without prompting. Directly addresses the core problem with a product-level solution rather than a workaround.

2026-05-12 — Boris Cherny: Auto Mode Replaces –dangerously-skip-permissions #

Type: supporting Boris Cherny (Claude Code creator) explicitly stated that Auto Mode is the replacement for --dangerously-skip-permissions, and that the old choice between “babysit the model or use YOLO” is now resolved. Published April 2026.

2026-05-12 — Run Parallel Sessions with Worktrees — Official Docs #

Type: supporting Native built-in worktree support via -w/--worktree flag confirmed. Default location .claude/worktrees/<name>/, creates new branch worktree-<name>. Validates the YOLO + worktrees pattern as a first-class supported workflow, even if Auto Mode is now preferred.

2026-05-12 — Headless Claude Code — the -p flag, end to end #

Type: supporting Documents --allowedTools as a key headless CLI flag: claude -p "task" --allowedTools "Bash,Read,Edit". Tool-level allowlists without requiring settings.json changes — useful for scripted CI/CD runs.

2026-05-12 — Claude Code: Auto-Approve Tools While Keeping a Safety Net with Hooks #

Type: supporting PermissionRequest hook fires before the permission dialog; returning {"behavior":"allow"} auto-approves. Enables conditional approval logic that static allowlists can’t express. Clarifies precedence: if the tool is in permissions.allow, the hook never fires.

2026-05-12 — github.com/claude-yolo/claude-yolo #

Type: supporting Community tooling for YOLO + parallel worktrees via tmux. Built-in -w flag for git isolation. Confirms the pattern has community investment and tooling beyond the bare --dangerously-skip-permissions flag.

2026-05-12 — Claude Code’s Broken Permission Model #

Type: contextual Documents a concrete gap in the current model: no way to express “allow writes to src/ and tests/ but not elsewhere”. Even with fine-grained allowlists, the granularity doesn’t extend to directory-scoped write permissions. An honest acknowledgment of what Auto Mode and allowlists don’t yet solve.

2026-05-12 — Pwning Claude Code in 8 Different Ways #

Type: contextual Documents pre-v1.0.93 vulnerabilities in the blocklist approach (e.g. man --html bypass). Anthropic’s response was switching to allowlist-by-default in v1.0.93+. Since v2.1.78, .git/ and .claude/ are protected paths even under --dangerously-skip-permissions. Provides security context for why the permission model evolved.

2026-05-12 — Live Blog: Code w/ Claude 2026 — Simon Willison #

Type: contextual Simon Willison documents a December 2025 incident of unintended data loss with --dangerously-skip-permissions. Confirms real-world risk; validates that the search for safer alternatives was warranted. Also covers Claude Code for Web using --dangerously-skip-permissions safely via containerization.

2026-05-12 — Claude Code Routines: Anthropic’s Answer to Unattended Dev Automation #

Type: contextual Anthropic’s managed cloud service for scheduled and API-triggered unattended workflows. Different model from local development — avoids the permission model entirely by running in managed infrastructure. Not a solution to the local development friction, but signals the direction for fully autonomous use cases.

How We’re Looking #

Keywords: "claude code" unattended autonomous run permission, "claude code" allowlist approval bypass, "claude code" YOLO worktree isolation, "claude code" hooks auto-approve, "claude code" permission model granularity, "claude code" headless agent unattended

Watch authors: Simon Willison, Boris Cherny

Preferred sources: docs.anthropic.com, simonwillison.net, github.com/anthropics, news.ycombinator.com

Negative filters: beginner content, “getting started” tutorials

Strategy Changelog #

Date	Change
2026-05-12	Quest created; seed answer from design discussion
2026-05-12	First gather cycle; Auto Mode (March 2026) discovered — significant update to answer; added –allowedTools flag, PermissionRequest hooks, containerized YOLO, permission model gaps
2026-05-14	Second gather cycle; incremental additions — /loop + /schedule commands, Approval Queue Pattern documented
2026-05-22	Third gather cycle; significant — Routines confirmed fully GA with 3 trigger types; Auto Mode now has 3 tiers (permissive/balanced/restrictive); PermissionDenied hook and defer decision documented; Agent SDK permissions surface identified
2026-05-27	Fourth gather cycle; minor — Auto Mode still “research preview” per InfoQ May 2026, not recommended for shared team environments; audit log gap for EU AI Act high-risk compliance noted as Q3 2026 deadline
2026-05-30	Fifth gather cycle; minor — Auto Mode precision metrics disclosed: 0.4% benign blocked, ~17% overeager pass-through; confirms defence-in-depth requirement for high-stakes unattended runs
2026-07-23	Thirteenth gather cycle; incremental — consolidated “Answer So Far” from a 12-cycle chronological stack into a distilled synthesis (full prior text archived in Synthesis History); AskUserQuestion 60s auto-continue (v2.1.198) rolled back to opt-in /config idle-timeout (v2.1.200), added to required-configuration checklist; “default” permission mode relabelled “Manual” (v2.1.200, cosmetic — flag corrected several secondary sources’ mischaracterisation as a breaking behaviour change); bash/PowerShell/Unicode permission-check bypass hardening and `dir/**` allow-rule scope fix (v2.1.214/216/218); quadratic-cost bug in long Auto Mode sessions fixed (v2.1.216)
2026-07-27	Fourteenth gather cycle; incremental — v2.1.219 fixed cross-worktree “always allow” persistence and added `sandbox.network.strictAllowlist`, both closing friction this quest has repeatedly flagged; Simon Willison’s original (2026-03-24) Auto Mode critique surfaced for the first time, sharpening the classifier-ceiling point with a concrete supply-chain example; new open bug (#61015 cluster) shows Routines’ MCP connector calls can hit an unsatisfiable “requires approval” wall, undercutting the “avoids the permission model entirely” framing for connector-based tasks; Claude Code Desktop’s mandatory (non-opt-in) worktree isolation noted as context refining the “YOLO + worktrees” framing
2026-08-02	Sixteenth gather cycle; no new evidence — all 6 keywords and both watch authors (Willison, Cherny) searched; every result either duplicated existing evidence (Auto Mode, sandboxing, worktree isolation, the “5 tips” thread, Steps of AI Adoption) or re-surfaced the techtimes.com “Auto Mode requires explicit opt-in” claim this quest already investigated and dismissed as a misreading of the v2.1.200 rename (2026-07-23 cycle) — re-checked against the same primary-source reasoning, still not supported. No changes made to “The Answer So Far”