How can you run Claude Code unattended on long task lists without getting stuck on approval prompts?

Status: active

Config: journals/quests/config/permission-friction-in-claude-code.yaml

The Answer So Far #

Note on this revision: this section was consolidated from a twelve-cycle chronological stack into a distilled synthesis on 2026-07-23; nothing was discarded — the full prior text is preserved verbatim as dated snapshots in Synthesis History below, including the 2026-10-14 snapshot prepended this cycle.

Core answer, shape stable since 2026-05-28 but with significant new operational and security findings: run Auto Mode as the default posture for unattended work, but understand it is a classifier, not a rule engine, and lacks an audit trail (Prof. Martin Monperrus). Layer allowlists, hooks, and Mods for surgical control, use Routines for fully managed cloud/scheduled runs, and use Dynamic Workflows (acceptEdits subagents) for large-scale file-modification tasks. YOLO + worktrees remains a valid legacy fallback, but with newly understood risks. This cycle’s updates are significant: (1) A deep dive into Auto Mode revealed it is an LLM-based classifier whose decisions are not logged, creating a critical audit gap (Prof. Martin Monperrus). (2) A new environment variable, CLAUDE_CODE_RETRY_WATCHDOG, makes unattended runs resilient to transient API errors (Developers Digest). (3) Anthropic launched Claude Mods, a new in-process plugin system for programmatic control over approvals (Medium). (4) A bug was identified where YOLO mode silently overrides read-only plan mode (Truefoundry).

Auto Mode is the default, but it is an unauditable classifier, not a hard security boundary. As of August 14, 2026, Auto Mode is the default for Pro, Max, and Team users (TechRadar). However, it is not a simple rule engine. It is a separate classifier model that evaluates tool calls against a detailed, natural-language policy of 88 rules (Prof. Martin Monperrus). Hard deny rules in settings.json are the only true hard boundary, as they are evaluated before the classifier is consulted. Critically, the classifier’s verdicts (allow or deny) are not written to session logs, leaving no audit trail for its decisions (Prof. Martin Monperrus). This reinforces that Auto Mode is a convenience and safety layer, not a sufficient security control on its own. The system remains vulnerable to previously identified exploits like CVE-2026-54316 & CVE-2026-45786 (Novee) and “confused environment” attacks (Simon Willison’s Weblog). In response, Anthropic’s hardening features like the “Containment Escape rule” and permissions.blockReadsOutsideWorkingDirectories (blakecrosley.com) should be seen as essential, and all high-stakes unattended runs require OS-level sandboxing as the primary backstop.

Native and ecosystem mechanisms provide increasingly robust headless control. For true “fail closed” runs in CI/CD, the --permission-prompts none flag remains the best native option, denying any action that would require a prompt (blakecrosley.com). A more granular native option is the auto-accept-edits mode, which approves file writes but still prompts for shell commands (shattered.io). For programmatic control, the new Claude Mods framework allows for in-process plugins that can auto-approve permissions based on custom logic (Medium). This is a more advanced alternative to the existing PermissionRequest hooks, which can also be used to programmatically approve or deny actions (AI Catchup). For enterprise environments, policy should be enforced via managed-settings.json, which allows administrators to set non-overridable deny rules and disable bypass modes entirely (Claude Code Hardening Guide).

Directory-scoped permissions remain an ecosystem solution, but misconfigurations are a proven risk. Anthropic’s “not planned” closure of the feature request for native directory scoping (Issue #35527) stands. Containerization remains the community’s preferred isolation method, exemplified by projects like con/yolo (GitHub). However, an empirical study of public repositories found that 3.1% contain allowlist rules that grant arbitrary command execution under the guise of a specific tool, such as Bash(python:*) (arXiv). This highlights a supply-chain risk where seemingly safe project configurations can create security holes. Furthermore, hooks committed to a repository’s .claude/settings.json will run automatically in non-interactive sessions, creating another vector for supply-chain attacks (AI Catchup).

Reliable unattended operation depends on an increasingly explicit configuration checklist. The move to Auto Mode by default does not remove the need for careful setup. An unattended run can still silently stall or run with a false sense of security without this checklist:

• Notification hook (agent_needs_input / agent_completed): Essential for awareness of prompts.
• Retry watchdog (CLAUDE_CODE_RETRY_WATCHDOG=1): Prevents long-running jobs from failing due to transient API capacity errors (Developers Digest).
• /config idle-timeout opt-in for AskUserQuestion: Prevents indefinite hangs.
• An explicit non-manual permission-mode flag: Required for scripts predating the default change.
• Effective network hardening: Strictest network controls like strictAllowlist must be placed in user (~/.claude/) or managed settings, as they are silently ignored if placed in repository-level settings (WorkOS).
• For teams: managed settings (allowManagedHooksOnly, strictKnownMarketplaces, permissions.disableBypassPermissionsMode): The only sanctioned defence against malicious plugins and user overrides (Claude Code Hardening Guide).

The current solution landscape:

Tier 1 — Recommended for unattended runs:

• Auto Mode with tiers (claude --auto-mode): The default, but must be used with a sandbox and the awareness that its decisions are not audited. Offers permissive, balanced, and restrictive levels.
• /loop or /goal with Auto Mode: Primitives for sustained execution.
• YOLO + worktrees / containers: --dangerously-skip-permissions combined with strong isolation. The con/yolo project is a concrete example (GitHub). Note that even in this mode, writes to protected paths like .git/ (Truefoundry) and rm on critical paths like ~ still prompt (Vibe Coder Journal). Beware of a bug (#17544) where this mode silently overrides read-only plan mode (Truefoundry).
• Headless mode with --permission-prompts none: The safest option for scripted/CI runs, as it denies any action that would require a prompt, ensuring a “fail closed” state (blakecrosley.com).

Tier 2 — Supplementary:

• Allowlists in settings.json: Pre-approve safe commands, but audit for overly broad patterns like Bash(python:*) which allow arbitrary execution (arXiv).
• PermissionRequest hooks & Claude Mods: For conditional, programmatic auto-approval. The auto-approve-claude-plan tool is a good example of a hook-based approach (GitHub), while Mods offer a newer, in-process alternative (Medium).
• --permission-prompt-tool <MCP_TOOL>: Designates a remote tool to handle approval decisions for headless runs.
• auto-accept-edits mode: A native mode for workflows where file edits are trusted but command execution requires oversight (shattered.io).

Tier 3 — Managed/cloud (GA):

• Claude Code Routines: Fully managed, triggered execution that bypasses the local permission model. Still subject to a bug where pre-authorized connectors can fail (Issue #61015).
• Claude Managed Agents with auto policy: A server-side equivalent to the local Auto Mode, where Anthropic’s infrastructure evaluates and runs or denies tool calls (CellCog).

Remaining gaps:

• Audit log gap. The discovery that Auto Mode’s classifier verdicts are not logged is a major gap for security and compliance (Prof. Martin Monperrus).
• The permission system is not a security boundary. The discovery of two CVEs (Novee) and the “confused environment” attack (Simon Willison’s Weblog) prove the system has direct vulnerabilities and can be bypassed, reinforcing that OS-level sandboxing is non-negotiable for high-stakes work.
• Misleading allowlist rules are a supply-chain risk. Overly permissive rules and malicious hooks committed to repositories are a demonstrated vector for unintended command execution (arXiv, AI Catchup).
• No native, granular filesystem permissions. The gap left by the closure of Issue #35527 persists.
• Routines connector bug. Issue #61015 remains open.

How We’re Looking #

Keywords: "claude code" unattended autonomous run permission, "claude code" allowlist approval bypass, "claude code" YOLO worktree isolation, "claude code" hooks auto-approve, "claude code" permission model granularity, "claude code" headless agent unattended

Watch authors: Simon Willison, Boris Cherny

Preferred sources: docs.anthropic.com, simonwillison.net, github.com/anthropics, news.ycombinator.com

Negative filters: beginner content, “getting started” tutorials

How this journal works #

Updated every 14 days: a search for new evidence on this question (6 search terms) classifies each item as supporting, contradictory or contextual, then rewrites The Answer So Far. Each update is an entry below; the previous answer is kept in Synthesis History.

Earlier history (to 17 October 2026): the evidence and synthesis history from before updates were stored as entries.

Strategy Changelog #