---
title: "Claude Code Auto Mode vs YOLO Mode | AgentRQ Guidelines"
url: https://agentrq.com/guidelines/yolo-mode/claude-code-auto-mode-vs-yolo-mode
description: "Claude Code auto mode vs YOLO mode: a classifier reviews risky actions in auto mode, while --dangerously-skip-permissions checks nothing. Which to use."
---

![](https://agentrq.com/assets/agent-icons/claude-agent.png) Checked October 9, 2026 | [All YOLO Mode guides](https://agentrq.com/guidelines/yolo-mode/)

# Claude Code Auto Mode vs YOLO Mode

Claude Code has two ways to stop asking you for permission. **Auto mode** (`claude --permission-mode auto`) hands each risky action to a second model, the classifier, which lets routine work through and blocks things like force pushes, `curl | bash` and production deploys. **YOLO mode** (`claude --dangerously-skip-permissions`, the `bypassPermissions` mode) checks nothing at all. Both remove the prompts. Only auto mode still has something watching.

This page is one of our [YOLO mode guides](https://agentrq.com/guidelines/yolo-mode/). For the YOLO switch itself, the settings key and the VS Code option, read [how to enable YOLO mode in Claude Code](https://agentrq.com/guidelines/yolo-mode/claude-code). Everything below was checked against Anthropic's permission modes documentation at code.claude.com and Claude Code 2.1.295 on October 9, 2026.

![Claude Code auto mode vs YOLO mode at a glance: the classifier, what each mode blocks, sandbox, prompt injection and per-task YOLO in AgentRQ](https://agentrq.com/assets/guidelines/yolo-mode-claude-code-auto-vs-yolo-og.png)

## Auto Mode vs YOLO Mode at a Glance

|  | Auto mode | YOLO mode (bypass permissions) |
| --- | --- | --- |
| Start it | `claude --permission-mode auto` | `claude --dangerously-skip-permissions` |
| Config value | `"defaultMode": "auto"` | `"defaultMode": "bypassPermissions"` |
| Who decides | A classifier model reviews each risky action | Nobody, everything runs |
| Reads and edits in your project | Run without asking | Run without asking |
| Shell commands and network calls | Reviewed by the classifier | Run without asking |
| Force push, curl piped to bash, prod deploys | Blocked by default | Run |
| Writes to protected paths like `.git` or `.claude` | Reviewed by the classifier | Run |
| Prompt injection from files or web pages | Classifier never sees tool results | No protection |
| Allow rules | Narrow ones kept, broad ones like `Bash(*)` dropped | Ignored, everything is allowed |
| Deny rules and explicit ask rules | Still apply | Still apply |
| Default starting mode | Yes, since 2.1.283, on supported models | Never |
| Extra cost | Classifier calls on some plans | None |
| Anthropic's advice | Long tasks, prompt fatigue | Isolated containers and VMs only |

## What Auto Mode Does in Claude Code

Auto mode removes the routine prompts but keeps a reviewer. Each action goes through a fixed order:

1. Your own allow, ask and deny rules are checked first.
2. Reads and file edits inside your working directory are approved straight away, apart from writes to protected paths.
3. Everything else, mainly shell commands, network calls and MCP tools, goes to the classifier. It sees your messages, Claude's tool calls and your CLAUDE.md, but not the tool results, so a hostile README or web page cannot talk it into approving something.
4. If the classifier blocks an action, Claude gets the reason and tries another way, and you get a notification. The action shows up in `/permissions` under **Recently denied**, where `r` retries it with your approval.

The classifier trusts your working directory and the git remotes that were set when the session started. Out of the box it blocks, among other things:

- → Downloading and running code, like `curl | bash`
- → Sending sensitive data to outside endpoints, or printing a live token into the transcript
- → Production deploys, migrations and `terraform destroy`
- → Force push, `git reset --hard`, `git clean -fd`, and amending a commit Claude did not make
- → Merging a pull request no human approved, or turning off CI checks
- → Deleting files that existed before the session, or a cloud resource Claude did not create
- → Launching another agent with its safety off, for example a nested `claude --dangerously-skip-permissions`

And it allows, without asking: local file work in the project, installing dependencies already declared in your manifests, read-only HTTP requests, and pushing to a branch of the repository you are working in. Run `claude auto-mode defaults` to print every rule as JSON.

You can also steer it in plain words. Tell Claude "don't push" and the classifier blocks pushes until you lift it. Approve a blocked action by naming it and its specifics, such as "force-push to my feature branch is fine", and the classifier clears that one action.

### When Auto Mode Falls Back to Asking

If the classifier blocks 3 actions in a row, or 20 in a session, auto mode pauses and Claude Code goes back to prompting you. Approving the prompted action turns auto mode back on. Repeated blocks usually mean the classifier does not know your infrastructure. An administrator can describe trusted repos, buckets and services in `autoMode.environment` in settings, and `claude auto-mode critique` gives AI feedback on custom rules.

In a non-interactive `claude -p` run there is nobody to ask, so a blocked action simply does not run and Claude keeps working.

### Who Can Use Auto Mode

- → **Models:** Claude Opus 4.6 or later, Sonnet 4.6 or later, Haiku 5.5 and the Fable models on the Anthropic API. On Bedrock, Google Cloud and Microsoft Foundry, Sonnet 5 or later, Opus 4.7 or later, Haiku 5.5 and Fable. Older models are not supported, and the session starts in manual mode instead.
- → **Plans:** all of them. Team and Enterprise administrators can turn it off with `"disableAutoMode": "disable"` under `permissions` in managed settings.
- → **Settings file:** like bypass, `"defaultMode": "auto"` only takes effect from `~/.claude/settings.json` or managed settings, not from a project's `.claude/settings.json`.

The classifier runs on Claude Sonnet 5 by default, not on your `/model` choice. On Enterprise plans and on API, Bedrock, Google Cloud and Foundry accounts its calls count toward your token usage, and each check adds a round trip before a shell command runs. Where Anthropic's server does the review as part of the normal model request, there are no extra calls.

## What YOLO Mode Does in Claude Code

YOLO mode is the `bypassPermissions` permission mode. It turns off the prompts and the safety checks, so every tool call runs at once, including writes to protected paths like `.git`, `.claude` and your shell config. Allow rules stop mattering, and nothing reviews what Claude does.

A few things still stop it: your `deny` rules and explicit `ask` rules, `rm` on critical paths like `/` or `~` (a prompt with a two-minute countdown), and questions Claude asks you directly. Bypass mode does not turn off the Bash sandbox if you enabled it with `/sandbox`.

Anthropic is blunt about it: bypass mode "offers no protection against prompt injection or unintended actions", and it should only be used in isolated containers or VMs without internet access. Claude Code refuses to start in bypass mode as root or under sudo, outside a recognized sandbox, and asks you to accept a warning the first time.

## Should You Use Auto Mode or YOLO Mode

Use **auto mode** for nearly everything you would have used YOLO for on your own machine: long refactors, test-fix loops, dependency upgrades, anything where you trust the direction and are tired of pressing Enter. It is already the default mode in recent Claude Code versions, so on a supported model you may be using it now. The handful of things it blocks are the ones you would want a second look at anyway.

Use **YOLO mode** only when the machine is disposable: a dev container, a CI runner or a throwaway VM with no secrets and no network beyond what the task needs. There it is faster and cheaper, with no classifier round trip and no false positives stopping the run. Never on your laptop with your SSH keys and cloud credentials sitting in the home directory.

Use **neither** for sensitive work where you want to see every command. Manual mode, or `acceptEdits` so file edits go through and shell commands still ask, is the right setting there.

## Auto Mode, YOLO Mode and AgentRQ

Both modes decide for the whole session, and both decide inside the terminal. [AgentRQ](https://agentrq.com) moves the decision to the task and to wherever you are.

- → **Get the prompts on your phone.** Connect Claude Code with the [Claude Code setup guide](https://agentrq.com/docs/connect-claude-code) and start it in manual or `acceptEdits` mode, not auto, so the decisions come to you rather than the classifier. Each permission request shows up in the AgentRQ task, on the web, on your phone or in Slack, where you answer **Allow Once**, **Always Allow** or **Deny**.
- → **YOLO for one task, not the session.** Flip the [YOLO mode](https://agentrq.com/features/yolo-mode) toggle on a single task, and every permission request in it is approved automatically while every other task in the workspace still asks. [Scheduled tasks](https://agentrq.com/features/task-scheduling) and [workflow](https://agentrq.com/features/workflows) steps have the same switch, so an unattended job can run in YOLO while interactive work stays supervised.
- → **See what ran.** The [tool call history](https://agentrq.com/features/tool-call-history) lists every call a task made, including the auto-approved ones, which is the review auto mode and YOLO mode both skip.

## FAQ

**What is the difference between auto mode and YOLO mode in Claude Code?** Auto mode sends risky actions to a classifier model that blocks things like force pushes and production deploys. YOLO mode, `--dangerously-skip-permissions`, approves everything with no review.

**Is auto mode safe?** Safer than YOLO, not perfectly safe. Anthropic says it reduces prompts but does not guarantee safety, so use it where you trust the general direction of the task.

**How do I turn on auto mode in Claude Code?** Start with `claude --permission-mode auto`, press Shift+Tab until the mode shows auto, or set `"defaultMode": "auto"` in `~/.claude/settings.json`. On Claude Code 2.1.283 or later with a supported model it is already the default.

**Why is auto mode unavailable?** Usually the model is too old, an administrator set `disableAutoMode`, or `defaultMode: "auto"` sits in a project settings file, where it is ignored.

**Does auto mode cost more?** On Enterprise plans and API, Bedrock, Google Cloud and Foundry accounts, the classifier calls count toward token usage. Reads and edits in your project skip the classifier, so the extra cost comes mainly from shell commands.

**What happens when auto mode blocks something?** Claude gets the reason and tries another approach, and the action is listed under Recently denied in `/permissions`. After 3 blocks in a row or 20 in a session, Claude Code goes back to asking you.

**When should I use YOLO mode instead of auto mode?** Only in a disposable container or VM with no secrets and limited network access, where speed matters more than review.

**Can I use YOLO mode for just one task?** Not in Claude Code itself, where the mode covers the session. In [AgentRQ](https://agentrq.com) you can turn on YOLO for a single task while the rest of the workspace still asks.

For every other agent, see [what YOLO mode is and how to turn it on in every coding agent](https://agentrq.com/blog/what-is-yolo-mode-and-how-to-turn-it-on-in-every-coding-agent).