Claude Code Auto Mode: Lessons From the Source Leak
Claude Code auto mode does not beg the model to behave. It puts a small, fast judge between the agent deciding to act and the agent acting, and it only hands control back to you after repeated denials. I found that out the day the source leaked.
I woke up this morning to chaos on my timeline. Anthropic messed up. They accidentally shipped a 59 megabyte source map file to npm.
Just like that, 512,000 lines of unobfuscated TypeScript for Claude Code hit the open internet. Everyone immediately rushed to find the juicy stuff. Hidden features. Unreleased code names.
I did not care about that.
I went looking for one specific thing:
How do they stop the AI from doing something spectacularly stupid?
If you build AI agents, you know the fear. You write an auto loop script. You give an LLM your API keys. You go grab a coffee. You come back, and it has either deleted your database or hallucinated a massive cloud bill.
I ran into this exact nightmare while building my terminal platform, Tradion. I needed my trading agents to run autonomously, but I could not trust them with the big red button. It’s the same fear I didn’t solve well enough the first time, on the open source AI project I built and never launched.
Most developers try to fix this with begging. We write prompts like, “You are a careful assistant. Please do not wipe my hard drive.”
Begging an LLM does not scale.
When I cracked open the leaked source code, I found Anthropic knows this too. They do not beg. They built a three layer security funnel. And yes, they literally named part of it the “YOLO Classifier.”
Here is how it actually works, and what I learned.
The Problem With Claude Code Auto Mode
We all want the dream. We want to type “build a SaaS app,” hit enter, and go to sleep.
But you cannot just set a flag to dangerouslySkipPermissions: true and hope for the best.
Anthropic built a system inside yoloClassifier.ts. It sits between the AI deciding to do something and the AI actually doing it.
Here is the three step funnel they use.
| Layer | Runs when | What it does |
|---|---|---|
| 1: Fast path | Every action | Lets reads, in-project edits and known-safe actions straight through. |
| 2: Fast judge | The action is risky, like a shell command | Sends a tiny payload to a constrained model that answers block or allow. |
| 3: Slow judge | The fast judge flags it | A slower reasoning pass makes the final call. After a block, the agent can try a safer path. |
Layer 1: The Fast Path
First, the system does a cheap check.
Is the action just reading data? Is it editing a normal file inside the project? Is it something already considered safe?
If yes, it goes through. No drama. No extra tokens. No slowdown.
Layer 2: The Fast Judge
If the action is risky, like running a shell command, it hits the YOLO classifier.
Anthropic does not send the entire chat history. That would burn money for no reason. Instead, they serialize the action into tiny JSONL style strings.
{"user":"fix the login bug"}
{"Bash":"rm -rf node_modules"}That tiny payload gets sent to a second, heavily constrained model. This model has a strict token budget. It is not there to brainstorm. It is not there to be creative. It is there to look at the action and make a binary judgment.
Block or allow.
It acts like a mechanical circuit breaker.
Layer 3: The Slow Judge
If the fast model flags the action, the system escalates.
Now the same payload goes to a slower reasoning pass that takes a more careful look at why the command might be dangerous before making the final call.
And this is the important part: if the action gets blocked, the system does not always instantly stop and hand control back to the user. It can deny the action and let the agent try a safer path first. Only after repeated denials does it escalate back to the human.
That part is smart.
Anthropic describes the same two-stage design in its engineering write-up on auto mode. A fast single-token filter runs first, and the careful reasoning runs only if that filter flags the action. The same write-up puts the escalation point at three denials in a row or 20 in total. The permission modes docs say the same about auto mode pausing and prompting you again.
My Hot Take
You cannot rely only on prompts for safety.
If you want an AI to act autonomously, you need actual walls.
You need a primary agent that does the creative work. But right next to it, you need a tiny, fast, brutally simple judge.
The judge does not write code. It does not talk to the user. It does not explain itself for six paragraphs.
It looks at an intended action and says yes or no.
That is it.
What You Should Do Next
Stop trusting your primary agent.
If you are building an AI app, a stock bot, or a coding assistant, build your own version of this. Route dangerous actions through a fast, cheap model. Make it judge the action, not the vibes.
Safety is not about nerfing the AI. It is about building gates, escape hatches, and escalation paths.
That is the real lesson here.
Running Claude Code all day also has a price tag, which I break down in Claude Code cost: 4 rules that work, 4 that don’t. The same “don’t beg the model, build a wall” reasoning is what my automated code review pipeline is built on, just aimed at merges instead of shell commands.
How are you keeping your own agents from doing something spectacularly stupid?