How Do I Stop Claude Code Auto Mode From Acting Without Confirmation?

To stop Claude Code acting without routine confirmation, leave auto mode. Cycle with Shift+Tab to Manual (default), start with claude --permission-mode default, or set "permissions": { "defaultMode": "default" } in ~/.claude/settings.json. Orgs can remove auto entirely with managed "disableAutoMode": "disable". Auto mode still runs a classifier before actions; it is not “no safety.” Bypass permissions is the opposite of this job.

Leave auto mode (session, default, org)

This session

Next launch. Start one terminal session in Manual:

claude --permission-mode default

manual is an alias for default from v2.1.200+.

Machine default. In user settings (~/.claude/settings.json) or managed settings:

{
  "permissions": {
    "defaultMode": "default"
  }
}

Project .claude/settings.json / .claude/settings.local.json: auto and bypassPermissions do not take effect for starting mode. VS Code claudeCode.initialPermissionMode accepts default/manual/acceptEdits/plan/bypassPermissions; not auto. Leave unset and pick Auto once if needed.

Org. Managed settings:

{
  "permissions": {
    "disableAutoMode": "disable"
  }
}

That removes auto from the Shift+Tab cycle; --permission-mode auto starts Manual instead.

Stay in auto but force confirmation for named actions

If long hands-off runs are useful but you still want a hard stop on push/PR:

{
  "permissions": {
    "ask": [
      "Bash(git push *)",
      "Bash(gh pr create *)"
    ]
  }
}

permissions.ask rules run before the classifier and always prompt in auto. Use permissions.deny for never-run. Chat “don’t push until I review” can be lost on compaction; [GAP] durable = ask/deny, not memory. Auto tab in /permissions (v2.1.246+) covers classifier boundaries; this page does not rehash autoMode.environment. Parallel sessions: parallel agents (link only).

What auto mode actually does (and what the HN Tell isn’t)

Auto mode skips routine permission prompts while a separate classifier reviews actions. It blocks escalation beyond the request, unrecognized infra, and hostile-content-driven actions; irreversible / exfil / prod categories are on the permission-modes page. Explicit ask rules, some interactive tools, and critical-path cases still prompt.

On Pro / Max / Team, built-in start is auto (v2.1.228+ macOS/Linux/WSL; v2.1.233+ native Windows). Enterprise / Console API / Bedrock / Agent Platform / Foundry / gateway start Manual unless set otherwise; why many operators “suddenly” see hands-off behavior.

A 2026-09-22 HN Tell claimed Claude prepared to sign a contract without asking. Discourse only. [GAP] No Anthropic primary; mode/rules unverified. Do not invent a “contract signing” classifier rule. Related (not auto-off): read-only git prompts.

Server-side classifier (2.1.278+) is not “turn off confirmation”

From 2.1.278, auto on Claude API + Enterprise and on Bedrock / Vertex (Agent Platform) / Foundry / gateways defaults to a server-side classifier (no classifier-overhead charge when the server checks). /status shows Auto mode server. Opt-out: CLAUDE_CODE_AUTO_MODE_SERVER=0; that changes where the classifier runs / billing, not whether you are in auto, and does not restore routine prompts.

2.1.273 briefly used a local classifier on Bedrock/Vertex/Foundry; superseded by 2.1.278. 2.1.280 (HEAD 2026-09-23) is auto fixes only; no default flip. Notes: 2.1.273–278. CLAUDE_CODE_ENABLE_AUTO_MODE has no effect from v2.1.207+.

Pitfalls

• Using bypass permissions / --dangerously-skip-permissions when you want more confirmation; that disables prompts and safety checks (isolated containers/VMs only).
• Confusing accept edits with Manual.
• Putting defaultMode: "auto" in project settings and expecting it to stick.
• Setting CLAUDE_CODE_AUTO_MODE_SERVER=0 thinking it leaves auto mode.
• Leading with the HN contract anecdote as Anthropic product truth.

Ops neighbors: rate limits · max effort.

FAQ

How do I switch out of auto mid-session?
Shift+Tab (CLI/JetBrains) or the mode indicator/selector → Manual.

How do I make Manual the default on Pro/Max/Team?
"permissions": { "defaultMode": "default" } in ~/.claude/settings.json (or managed). Built-in start is auto from v2.1.228+ unless you set this.

Does CLAUDE_CODE_AUTO_MODE_SERVER=0 disable auto mode?
No. It opts out of server-side classifier routing on Bedrock/Vertex/Foundry/gateways. Leave auto with permission mode, not this env var.

Is bypass permissions safer if I want fewer surprises?
No. Bypass removes prompts. For confirmation, use Manual or permissions.ask.

Can I keep auto but always approve git push?
Yes; add Bash(git push *) (and similar) under permissions.ask. Ask rules evaluate before the classifier.

Sources

Checked 2026-09-23.

• Choose a permission mode; auto vs Manual; Shift+Tab; defaultMode; disableAutoMode; ask-before-classifier
• Configure auto mode; ask/deny boundaries; classifier scope
• Auto mode classifier request charges; 2.1.278 server default; still accurate after 2.1.280
• Environment variables; CLAUDE_CODE_AUTO_MODE_SERVER, obsolete CLAUDE_CODE_ENABLE_AUTO_MODE
• CHANGELOG; 2.1.278 server classifier; 2.1.273 superseded local default; 2.1.280 auto fixes (HEAD)
• HN item 49798257; discourse only; [GAP] no official primary