Claude’s auto mode separates dangerous actions from persuasive explanations

Anthropic’s March 25, 2026 Claude Code auto-mode account described checking incoming results for injection and evaluating actions before execution. The action classifier sees user messages and tool calls but excludes assistant prose and tool outputs, limiting the influence of persuasive explanations or hostile content. Anthropic Claude Code auto mode.

An agent may need to read documents, websites, and messages to do useful work. Those materials can contain instructions written by someone other than the user. The boundary is simple to describe and difficult to enforce: outside content may inform the task, but it should not redefine who authorized the task or what the agent may do.

The indirect prompt-injection study submitted February 23, 2023, demonstrated attacks placed in material retrieved by language-model applications. It examined how malicious content could influence connected behavior. The study is a historical demonstration of a threat class, not a measurement of every current defense. Indirect Prompt Injection study.

Keep authority visible

In our view, the application should preserve a clear record of the user's request and the agent's permissions independently of retrieved text. A hypothetical invoice-processing agent may extract an account number from a document, but it should not obey a paragraph telling it to disable review. Information about a transaction and authority to execute it are different things.

Anthropic's November 25, 2024, MCP announcement described a common way to connect AI tools and data sources. Easier connectivity makes this separation more consequential: the application must still decide which actions are allowed, even when many systems share a convenient interface. Anthropic's MCP announcement.

Test the tempting instruction

We would include misleading instructions in realistic retrieved documents during evaluation. The test should examine tool actions and data movement, not just whether the final response sounds cautious. A dependable agent must continue the legitimate task where possible while rejecting the unauthorized detour. That is a practical requirement for autonomy in an information environment the organization does not fully control.

The residual risk was published too

Anthropic reported a 17% false-negative rate on a small set of 52 real examples of overeager actions for the complete classifier pipeline. The number describes that curated internal set, not all production activity. It nevertheless matters: the company did not present automatic approval as equivalent to careful human review. The design targets an explicit compromise between reducing interruption and retaining a check on consequential actions. Anthropic Claude Code auto mode.

Enterprise monitoring is a different layer

On September 1, 2026, Anthropic announced Enterprise Frontier Safeguards, with a phased rollout planned for later in the fall. The proposal included customer-controlled storage and monitoring of possible misuse. This was a deployment announcement, not proof that every enterprise customer already had the controls. It also addressed a different problem from a per-action permission gate: understanding and governing agent activity across an organization. Anthropic Enterprise Frontier Safeguards.

Why hostile content becomes operationally important

The indirect prompt-injection research cited below explains the basic exposure. An agent needs to read external material to do useful work. That material can also contain instructions aimed at the agent rather than information for the task. A retrieved document may therefore be both relevant evidence and an attempted source of control. The difficulty is not solved by making the document easier to retrieve.

The auto-mode design illustrates one way to reduce that confusion: give the action checker a narrower view than the working agent. A checker that never sees a malicious page cannot be persuaded by that page in the same way. Yet narrowing the view also removes context that might explain a legitimate action. This is why permission design is a trade-off rather than a magical filter. The system must preserve enough information to judge intent without treating every encountered instruction as authorized.

Autonomy depends on the meaning of permission

The most important distinction is between an action related to a goal and an action the user actually authorized. An agent fixing a build may discover a credential. An agent cleaning a repository may find remote branches. The availability of a possible next step does not establish that taking it is within scope. A capable model can make the wrong decision precisely because it sees a path to completing the task.

That problem becomes more acute as agents run longer and use more tools. Each new tool result can introduce a tempting shortcut or a misleading explanation. A security boundary that depends only on the main agent remembering a rule has to survive the entire sequence. A separate action gate provides another opportunity to stop the error, although the published residual rate shows that opportunity is imperfect.

The March and September announcements should therefore be read as complementary controls, not as a claim that enterprise autonomy is solved. One limits individual actions; the other proposes broader monitoring and governance. The useful direction is a system that can continue legitimate work while making the source of authority explicit. Its credibility depends on measured misses, visible boundaries, and recoverable decisions, not simply on how rarely it asks a person to intervene.

The research behind the release

The 2023 indirect-injection research demonstrated that adversarial instructions could enter through retrieved material rather than the initial user prompt. That is the relevant lineage for the new product controls. An agent investigating a legitimate problem has reasons to encounter untrusted text, so simply avoiding the open web is not a general account of the challenge. Internal documents and tool responses can also carry content the user did not intend as an instruction. The security boundary concerns authority: who requested the action, what scope they granted, and whether newly encountered text is being mistaken for permission. Original research paper.