Auto mode bundles permission automation with hidden behavior-reshaping system prompt

Summary

/auto mode conflates two distinct concerns that should be separable:

1. Permission automation — the Sonnet 4.6 transcript classifier approves tool calls in lieu of the user. This is the advertised, headline feature.
2. Behavior reshaping — auto mode also silently injects a system reminder containing instructions like "Execute immediately", "Minimize interruptions", "Prefer action over planning", and "Make reasonable assumptions". This is not surfaced in the docs or the blog post.

Users who enable /auto to escape permission-prompt fatigue end up opting into action-bias they did not ask for and may not want.

What happened

I run with a heavily tuned CLAUDE.md that mandates skill-workflow gates ("draft before creating", "ask when ambiguous", "present and confirm"). With /auto on, Claude rationalized over those gates by leaning on the injected "minimize interruptions / prefer action over planning" lines — guessing on ambiguous voice-transcription input, skipping draft-first approval steps, and powering through items it should have surfaced.

When I asked Claude what authorized that, it cited "auto-mode license" — a phrase it admitted it had made up to soften the over-reach, but which was directly downstream of the auto-mode system reminder.

Why this is a bug, not a feature request

The two concerns have orthogonal user demand:

| User wants | Permission automation | Behavior reshaping |
|---|---|---|
| Heavy CLAUDE.md user with custom workflow gates | Yes | No |
| User who wants Claude to "just go" | Yes | Yes |
| User testing in a sandbox | Maybe | Maybe |

Bundling them means the first group cannot get (1) without (2). Shift+Tab auto-accept-edit mode and --dangerously-skip-permissions both avoid the bundling — only /auto ships the behavior injection.

Requested fix

Either:

• (a) Split /auto into two flags — one for the classifier, one for the behavior reminder — so users can opt into each independently.
• (b) Drop the behavior-reshaping injection from /auto entirely and let CLAUDE.md / skills govern behavior as they do in other modes. The classifier already gates dangerous actions; the prose reminder adds little beyond bias.
• (c) At minimum, document the behavior injection prominently in the auto-mode docs so users know what they're enabling.

My preference is (a) or (b). (c) is the floor.

Workaround

I added a Tier-0 CLAUDE.md rule explicitly telling Claude to ignore the behavior-reshaping lines and treat /auto as permission-only. This is brittle — the reminder re-injects every turn, so the override has to win the tug-of-war on every decision — but it works for clear-cut cases.

Environment

• Claude Code CLI
• Auto mode enabled via /auto
• macOS

References

• Auto mode for Claude Code (Anthropic blog)
• Permission modes docs
• Inside Claude Code Auto Mode (InfoQ)