Hacker News

points by bcherny 8 hours ago | 0 comments

Yeah, by default we err on the side of caution. That said, the auto mode classifier is fully customizable based on your team’s usage. Two ways to tune it:

1. After a command is blocked, run /permissions to retry and allow it going forward

2. More deeply configure the classifier itself: https://code.claude.com/docs/en/auto-mode-config

We are working on making these easier and more automated.

[–] kay_o 7 hours ago

For some reason claude code hates using the read/write/grep tools and defaults to complex sed, awk, grep Bash:* runs which results in always consistently ignoring auto mode due to the classifier not knowing what to do with a 10-line long bash pipe instead of a read + pre/post read and write hooks being ignored and not firing, what is up with that?

[–] awfulneutral 6 hours ago

I don't understand this either, it makes commands really hard to parse. It seems like 90% of what claude does could be going through some mcp tool that could be easily sandboxed instead of bash gibberish.

[–] kay_o 6 hours ago

If it was human approval ? Read("./file.name") then Bash("docker compose run unit-tests"), sure, I can read that fine !

As I was reading your post I got another approval request that auto-mode did not understand. It was a single Bash call !!23!! lines tall on a retina mac display with six different variables. If anything this is the cause of approval fatigue and auto mode does nothing helpful when this is every call. I also have in my claude.md and global instructions to use tool calls rather than bash grep/cat/find, which are disregarded.

[–] awfulneutral 5 hours ago

Yeah I agree, I didn't used to feel approval fatigue but lately the huge bash chains are giving it to me. I haven't even tried auto mode. I'm just sure it has some definition of "safe" that does not align with my own.

[–] kay_o 4 hours ago

I'm not sure when claude started preferring huge bash chains but auto mode tends to decline most of them and drop to a permission prompt -- getting rid of the use of auto mode -- because it refuses to handle anything chained with expansions, variables or similar items

[–] dcrazy 6 hours ago

I use a hook to deny attempts to invoke `grep /` and `find /`, even as part of a complex pipeline.

[–] awfulneutral 6 hours ago

I had claude write a hook to deny `find /`. It tested it thoroughly. Much later I learned that the hook denied `find /` but allowed everything else that existing permissions denied, like running whatever random python/bash code it wanted without asking.

[–] written-beyond 8 hours ago

Auto mode really easily gaslights itself when it runs into a roadblock and starts deviating so far away from its intended goal that I don't let automode run without me reading what it's actually trying.

I frequently hit stop on and auto mode task to prevent it from completely flooding my context with some completely unrelated garbage.

Claude really should push away tasks that end up needing more exploration in worker contexts. That way the workers can maintain a sensible amount of context without pushing the main chat into the dumb region.

[–] skeledrew 7 hours ago

You should note that auto-mode is handled by a different session (and likely model) from your actual. There's no road block or deviation or context flooding; all it does is monitor the model actually doing the work and block it from potentially problematic actions (which you can usually override by saying you explicitly give permission for X), nothing more.

[–] bulder 6 hours ago

The context pollution happens when a denial triggers but the model still keeps attempting the harmful action via alternative avenues. It's got nothing to do with the auto-mode eval model's actual output.