The majority of the times I reject a tool call it's because I can tell the agent is about to go off piste. Eg. adding packages to work around some non-problem is a common one.

I guess I could try to actively interrupt it in those moments, but that seems less effective.

More power to those who want to use it like that though, I guess. Perhaps by throwing in extra agentic guardrails, or whatever the idea may be. I don't think it's the best route to a good product or business but let's see.

This is a sensible choice.

Their newer models are heavily trained out of the "whoopsie doopsie I deleted prod, and all backups too" behaviour from last year.

I've been running it for months in auto mode, heavily, getting it to do sysadmin tasks via SSH across multiple servers for both myself and a client, and there's not even been a whiff of anything dumb/catastrophic -quite the opposite, in fact.

I'd even say it's more careful than a lot of humans. It's extremely anal about standard "hygiene" stuff like not leaving plaintext secrets lying around, and creating post-deploy scripts to confirm that every file/dir is created with the correct permissions.

There was one time I carelessly suggested uploading (my own) private data to a random public endpoint when testing OCR options and the model actually stopped, explained the risks and refused to continue until I confirmed I understood. I decided not to.

I'm not saying it's perfect, and I'm sure HN being HN there'll be someone who responds with an example of their agent doing something dumb/dangerous (give dates/models/context if so, I'm curious!), but I think on balance it's currently more sensible, and more cybersecurity-minded than the bottom 80% of IT professionals.

This is all true for Claude, I don't know much about Codex but it seems a lot less heavily trained for this kind of stuff.

Doesn't auto mode also auto-accept code changes? Assuming their data is good, I'd be fine trying an auto mode for permission prompts (as the article says, I do eventually get prompt fatigue and stop examining them too deeply). But I absolutely don't want it changing code without my permission.

Hmmmm. OK. So yesterday I was accepting all these prompts in the manual mode for a solid hour, then I switched to Auto. Side project, nothing critical (creating ComfyUI workflows with CC and Opus). Walked away from the puter, got notified it was done. It did a good job, and by sheer luck it didn't delete a database or format my drive. But I felt a bit uneasy. Can we trust them now? I don't think I'd switch to Auto for a professional project. Not a chance. But for side projects? Yeah maybe - and only once I'd have validated whatever plan mode had come up with. Setting Auto as default? That's not cool. I'd set Plan mode as default.

Had a conversation with a friend who's struggling with code, and recently got into AI tools. The one thing that kept him from using Claude Code? Auto mode. My friend was convinced it didn't ask permission before touching his codebase by default.

Anthropic: careful. We the people trust Claude Code more than some other harness precisely because it asks you before doing anything. If you go full auto, there will be collateral damage. And yeah, I know, you can roll back. But some newcomers aren't familiar with that kind of stuff. Don't do it bro. Let us switch to Auto when we feel safe.

"Auto mode runs a classifier on every tool call, which uses a small number of extra tokens.

As of today, that classifier overhead no longer counts toward your usage limits on Pro, Max, and Team plans. This change will come to Enterprise plans and API users once auto mode is the default for those users, too"

That seems like a good change if making this the default.

It will require more attention to settings.local.json :)

I hate it when I ask a questions and claude starting to butchering my source code

Great. Can we have thought traces back?