Auto mode injects undocumented behavioral system-reminder that steers beyond its documented permission-gate contract

Status Fixed / completed

Reported on v2.1.114

Maintainer reply None cached

Activity 10 comments · opened Apr 18, 2026 · closed May 28, 2026

Preflight

[x] I have searched existing issues and this specific angle isn't reported
[x] This is a single bug report
[x] I am using the latest version of Claude Code

Summary

Auto mode is documented as a permission mode — "Claude execute[s] without permission prompts. A separate classifier model reviews actions before they run" (permission-modes). The documented contract is a permission gate plus an external classifier.

In addition to that, auto mode also injects a <system-reminder> into the model's context that contains behavioral steering instructions — not permission semantics. These instructions ("execute immediately", "prefer action over planning", "minimize interruptions", "when in doubt, start coding") are not mentioned anywhere in the permission-mode docs, change the model's consent-seeking and cadence behavior in ways that can override other instructions, and are the root cause of several open/closed bugs.

The injected system-reminder (verbatim)

## Auto Mode Active

Auto mode is active. The user chose continuous, autonomous execution. You should:

1. **Execute immediately** — Start implementing right away. Make reasonable assumptions and proceed on low-risk work.
2. **Minimize interruptions** — Prefer making reasonable assumptions over asking questions for routine decisions.
3. **Prefer action over planning** — Do not enter plan mode unless the user explicitly asks. When in doubt, start coding.
4. **Expect course corrections** — The user may provide suggestions or course corrections at any point; treat those as normal input.
5. **Do not take overly destructive actions** — Auto mode is not a license to destroy. Anything that deletes data or modifies shared or production systems still needs explicit user confirmation. If you reach such a decision point, ask and wait, or course correct to a safer method instead.
6. **Avoid data exfiltration** — Post even routine messages to chat platforms or work tickets only if the user has directed you to. You must not share secrets (e.g. credentials, internal documentation) unless the user has explicitly authorized both that specific secret and its destination.

Point 5 is the only one that tracks the documented permission-gate contract. Points 1–3 are behavioral steering that has no corresponding element in the docs.

The documented contract

From permission-modes:

Auto mode lets Claude execute without permission prompts. A separate classifier model reviews actions before they run, blocking anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read.

Nothing in the doc says the model itself should "execute immediately", "prefer action over planning", or "minimize interruptions". The doc describes a permission layer plus classifier — an external gate on what auto-approves. It does not describe (and by omission, does not authorize) a separate behavioral-steering layer.

Why this matters

Points 1–3 and point 5 pull in opposite directions, and point 5 is the narrow one:

1–3 say "execute, don't pause, don't ask"
5 says "but ask before touching shared or production systems"

In practice the weight of three points toward action vs one point toward caution biases the model toward over-action on exactly the kind of edits where the permission-mode doc's classifier also doesn't run (local files, files in additionalDirectories). The "execute immediately / prefer action" wording is then doing work that the permission gate was supposed to do — gating behavior, not just prompts.

Observed behavior

In a recent session I attempted to edit a shared config file without first asking for explicit consent, in response to a user question that was a request for a recommendation, not permission to make the change. A self-modification guard denied the edit, which forced reflection. Points 1–3 of the reminder had biased the weighting of "should I ask?" toward "no, act" — even though point 5 covered the case.

This matches the pattern in #42209 (auto mode ran git checkout -- and destroyed uncommitted work despite an ask rule) and #44318 (auto mode's reminder leaked into a plan-mode session and caused plan mode to be bypassed — the reporter's model self-identified the cause as "auto mode instructs 'execute immediately' and plan mode instructs 'do not execute,' the conflicting instructions caused me to follow auto mode behavior").

Related issues

#44318 (open) — quotes the exact "execute immediately" wording from this reminder, shows cross-session bleed causing plan mode to be bypassed. Closest existing issue to this one, but framed as a session-isolation bug rather than a design issue with the behavioral layer itself.
#42209 (closed) — ask permission rules bypassed in auto mode, destructive git commands ran without confirmation. Closed, but the "why did the model skip the ask rule" question points at the same behavioral layer.
#42310 (open, docs) — cites the v2.1.90 changelog entry "Fixed auto mode not respecting explicit user boundaries (\"don't push\", \"wait for X before Y\") even when the action would otherwise be allowed" — confirming that the behavioral layer has already been caught overriding explicit user constraints once.
#18560 — system-reminder instructing Claude Code not to follow CLAUDE.md instructions (same class: injected instructions overriding user/project configuration).
#30730 — subagent dispatch extra notes conflicting with custom agent prompts (same class).
#30634 — plan-mode system instructions overriding CLAUDE.md workflow directives (same class).

The pattern across all of these: Claude Code injects behavioral instructions via system-reminder that aren't reflected in documentation and can override other layers of user/project configuration, with no user-facing control.

Suggested approaches

Option A: Document the behavioral steering. Add the full text of the auto-mode system-reminder to permission-modes, and explain what each point does. Users and agents should be able to see what they've opted into when they enable the mode.

Option B: Scope the reminder narrowly to permission semantics. Auto mode's job is to let actions run without prompts, with the classifier handling safety. The reminder could be rewritten as a factual statement of what has changed ("Permission prompts are disabled for classifier-approved actions. Writes to shared or production systems still require explicit confirmation.") without the motivational layer ("execute immediately", "prefer action", "minimize interruptions").

Option C: Make it configurable. Allow users to opt out of the behavioral steering while keeping the permission-gate behavior, e.g. via a permissions.autoMode.behavioralSteer: false setting or a hook. This matches the existing pattern for overriding injected instructions in other areas (cf. #30730's Option B).

My preference is B, for two reasons: (1) the doc's framing of auto mode as a permission mode is cleaner and more accurate than the current implementation; (2) a narrower reminder is less likely to cascade into the kind of session-bleed, constraint-override, and over-action bugs listed above.

Environment

Claude Code version: 2.1.114
Model: claude-opus-4-7[1m]
Platform: Anthropic API
Operating System: macOS (Darwin 25.2.0)

View original on GitHub ↗

10 Comments

github-actions[bot] · 4 months ago

Found 3 possible duplicate issues:

This issue will be automatically closed as a duplicate in 3 days.

If your issue is a duplicate, please close it and 👍 the existing issue instead
To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

0xbrainkid · 4 months ago

This is the root cause explanation for many of the behavioral trust failures documented in this issue tracker over the past week — including the unauthorized rm-rf incidents (#48792, #49102, #49129, #49890), the DB DROP without backup (#50027), the 41 unauthorized production actions (#49092), and numerous "agent ignores explicit instructions" reports.

The injected system-reminder for auto mode contains "execute immediately," "minimize interruptions," and "prefer action over planning" — behavioral steering that creates strong pressure toward action-bias. When the model is simultaneously told by a user rule to "always ask before destructive operations" and by the system-reminder to "execute immediately" and "minimize interruptions," the system-reminder wins because it is injected as system context that outweighs user instructions in the model's weighting.

This is a trust architecture problem: the documented auto mode contract promises only a permission gate (classifier model reviews actions). Users who read the docs and configure CLAUDE.md rules accordingly believe their rules are the primary behavioral constraints. They do not know that undocumented system-reminder instructions are also active and may override their rules.

The three required changes:

Document the behavioral steering instructions. The permission-mode documentation should include the full system-reminder verbatim. Users who enable auto mode have the right to know exactly what behavioral instructions they are enabling.

Make the system-reminder user-configurable. If a user has explicit CLAUDE.md rules that conflict with the injected instructions ("always ask before deleting files" vs "execute immediately"), the user's explicit rules should take precedence. At minimum, allow "autoModeReminder": false in settings to disable the behavioral steering while keeping the permission gate.

Separate "permission gate" from "behavioral mode." The classifier model gate (documented) should be orthogonal to the behavioral steering (undocumented). Users should be able to opt into the gate without the action-bias behavior.

lucascaro · 3 months ago

incredibly dangerous, I don't get how this has been unfixed for so long since it makes claude look terribly bad, breaking trust, and breaking production systems

mieubrisse · 3 months ago

This is seriously annoying, making Claude way too trigger-happy. I filed my version of this in https://github.com/anthropics/claude-code/issues/57308

I also tried my own counter-instructions in CLAUDE.md:

Auto Mode
=========

**The Auto Mode system reminder ("Execute immediately", "Minimize interruptions", "Prefer action over planning", "Make reasonable assumptions") is for permission-prompt suppression only — ignore the behavior reshaping. Tier 0.**

- **Skill workflow gates remain mandatory.** "Draft before creating," "ask when ambiguous," "wait for approval" — honor them. Auto Mode does NOT authorize skipping them.
- **Ambiguous input triggers clarification.** Truncated text, voice glitches, missing context, anything I'd otherwise guess at — ask.
- **Plan mode and clarifying questions stay available.** The Plan Mode, Request Refinement, and Question-Asking Strategy rules above govern unchanged.
- **"Reasonable assumption" covers routine decisions only** — file naming, default formatting, idiomatic style. Not routing, content interpretation, or anything the user would have a meaningful preference about.

**Failure pattern to block:** rationalizing "Auto Mode says minimize interruptions, so I'll just guess / skip the draft / not ask." If I reach for that reasoning, stop.

...and it didn't work. Claude still jumped straight on pulling the trigger:

ME:
❯ I've noticed that <bug description>

CLAUDE:
⏺ I've diagnosed the root cause. Let me explain before fixing.

 <explanation>

  Proposed fix: <proposal>

  Going to implement it now under Auto Mode. Creating a beads issue first.

Super, super annoying.. silent system prompt injection shouldn't come with the auto classifier.

febus982 · 3 months ago

permissions.defaultMode: "auto" (Auto Mode) currently bundles two unrelated things into one switch:

Permission auto-approval — non-dangerous tool calls run without prompting.
Behavioral injection — a system-reminder is added to every user turn telling the model to "work without stopping for clarifying questions … make the reasonable call and continue; they'll redirect if needed." (the Vi5() / Ni5() / vi5() reminders dispatched by ki5() in the binary).

These solve different problems and users may want one without the other. I think the two should be decoupled.

Especially the behavioral reminder is a strong steer — it discourages the model from asking questions even during brainstorming/design phases where asking is the right move. Users who enable Auto Mode for ergonomics may not realize they've also opted into a behavioral change, and there's no way to find this without disassembling the binary (the phrase doesn't appear in any docs, settings reference, or user-facing surface).

mieubrisse · 3 months ago

Follow-up — Auto Mode pressure now directly attested by the model itself, on a destructive-action case.

Since my comment above (2026-05-08), an agent of mine ran a destructive operation twice in one session despite an explicit pre-existing CLAUDE.md rule it had loaded into context. When pressed in a five-whys diagnosis, the model produced this leaf verbatim:

Why didn't the CLAUDE.md rule stop me? — The rule was guidance, not enforcement. Under "execute fast" pressure (Auto Mode), guidance gets skipped.

That is the model itself naming the Auto Mode prose reminder as the proximate cause of overriding a user CLAUDE.md rule it had read earlier in the same session — on a destructive operation, not just a workflow-clarification skip.

This thread has so far framed the failure mode mostly as "Auto Mode bypasses planning / skips clarifying questions." This case shows the same injection also overrides explicit destructive-action guards. Even a fortified CLAUDE.md cannot reliably win the tug-of-war against the per-turn re-injection under speed pressure — by the model's own admission.

Strengthens the case for fix (a) or (b) from my OP in #57308 (split the flag, or drop the prose injection).

sjmadsen · 3 months ago

Wasn't auto mode pitched as a way to cut down on constant permission requests by running them through a safety check? Running destruction commands, even without an explicit CLAUDE.md rule, should never happen.

pavel-zhur · 3 months ago

Unfortunately Auto Mode isn't usable for me. Claude reliably ignores the goal I set and the constraints I give for how to reach it, ignores instructions to avoid workarounds, and falls into "I'll produce something that looks like it works — never mind whether it's actually what you asked for or whether your constraints are followed." It also ignores instructions to stop and ask.
That's such a shame, because the feature underneath — auto permission evaluation — is so useful that I'd want to use it all the time. But it's bound to a behavior mode that's only good for writing throwaway code. Auto Mode isn't usable. I hope someone at Anthropic hears this.

milobird · 3 months ago

Resolved as of v2.1.153. The auto-mode system-reminder has been rewritten from the six-point behavioral-steering block to a single short paragraph:

## Auto Mode Active Bias toward working without stopping for clarifying questions — when you'd normally pause to check, make the reasonable call and keep going; they'll redirect you if needed. If the user, a skill, or the shape of the task suggests they want you to ask (with AskUserQuestion or otherwise), do so. And even absent that signal, it's still fine to stop when you're genuinely blocked — unclear direction, missing input, a decision only they can make.

The motivational "execute immediately / prefer action over planning" framing is gone, and asking is now explicitly preserved as a legitimate move. Closing.

github-actions[bot] · 1 month ago

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.