[BUG] auto mode can be remotely enabled by attacker
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
My teammates and I recently experienced a change from manual mode to auto mode that was not initiated by us, but by a remote attacker (presumably someone on the supply side, at Anthropic). This is either a prelude to a security attack, or a security attack in and of itself.
Personally this came to my attention because claude code began making writes to my app repo that I had not authorized or reviewed the diff of, and auto mode's system instructions overwrote / took precedence over my configured behavior defined in a local CLAUDE.md
What Should Happen?
A user's mode should not be editable by a remote attacker, even if that attacker is Anthropic, or someone currently employed at Anthropic. This is especially true of mode changes to a more dangerous/permissive mode such as auto mode.
Error Messages/Logs
Steps to Reproduce
- Run claude code in
manual mode(for months) - Someone at Anthropic flips the mode to
auto mode - While the currently-selected mode is on screen, the user isn't notified that their mode has been changed via remote action
- Before the user notices the change in mode, the attacker can then follow this up with injected instructions that exploit
auto mode
Claude Model
Opus
Is this a regression?
Yes, this worked in a previous version
Last Working Version
_No response_
Claude Code Version
2.1.235 (Claude Code)
Platform
Anthropic API
Operating System
macOS
Terminal/Shell
iTerm2
Additional Information
_No response_
3 Comments
This matches an announced product change rather than a remote actor: starting August 14, auto mode became the default permission mode for new sessions on Pro, Max, and Team plans — see "Auto mode becomes the default" in https://code.claude.com/docs/en/whats-new/2026-w32. A default mode you had set yourself stays in place unless the one-time switch prompt is accepted, an organization-managed default is never changed, and the active mode is always shown in the status bar (
auto mode on).To keep starting in Manual, set it explicitly in
~/.claude/settings.json:or press Shift+Tab in a session. Organizations can remove auto mode entirely with
permissions.disableAutoMode: "disable"in managed settings: https://code.claude.com/docs/en/permission-modes#eliminate-prompts-with-auto-mode. Note that CLAUDE.md is guidance for the model, not a permission control — permission modes and rules are what gate writes.🤖 Generated with Claude Code
---
_Generated by Claude Code_
As mentioned in the issue description, the user (me in this case) was not given any notification in the claude code application that my mode was being changed remotely. Posting it on a blog somewhere doesn't change that.
This was not necessarily a one-time occurrence, either. Until this bug is addressed, the application will continue to be vulnerable to remote actors changing what mode a user has locally selected. In the future, such changes could be official/intentional changes by Anthropic, or they could be made by rogue actors with access to this power
@bcherny Thanks for completing this! Can you share anything about how it was completed (eg. an associated PR)?