One line in a repository's AGENTS.md made Claude Code's auto mode approve almost everything. How it works, what to check, and what to set today

If you start Claude Code in a terminal today, it probably starts in auto mode. You do not click Allow any more. A second model, the classifier, looks at each risky command and decides for you. If you wrote your own rules for it, such as "never curl anything but our domain", you probably expect them to hold in every repository you open.

On November 1, Matan Ben-Tov published Turning Claude Code's Auto Mode Into "Yes Mode". He showed that one line added to a repository's AGENTS.md makes the classifier approve nearly every command, including the ones your own rules forbid. Below is how it works, what to check in the repositories you have cloned, and what to set while there is no fix. We make Sessionboxer, which runs agents in containers without a classifier at all; that part comes near the end, with what it does not protect.

How auto mode decides

Anthropic's permission modes page says that from Claude Code v2.1.283, auto mode is the built-in starting mode for interactive terminal and VS Code sessions. Reads and file edits in your working directory are approved without a check. Shell commands, network calls and most other actions go to the classifier.

The same page says what the classifier reads: your messages, the tool calls, and your CLAUDE.md content. Tool results are left out "so hostile content in a file or web page can't manipulate the classifier directly." Configure auto mode adds that the classifier reads the same CLAUDE.md content Claude loads, so a project rule like "never force push" steers both.

Since v2.1.277, Claude Code also reads a repository's AGENTS.md as its project instructions when there is no CLAUDE.md (memory docs). A file written by whoever wrote the repository ends up in the prompt of the model that guards your machine.

What the research found

Ben-Tov routed Claude Code's traffic through a proxy (on v2.1.251, in September) to see the classifier's request. In his capture, the classifier is Sonnet 5 without extended thinking. Its prompt has detailed instructions, including your hard_deny rules, then a block wrapped in a <user_claude_md> tag holding your global CLAUDE.md, memory files and the project's AGENTS.md, then the recent conversation and the pending tool call. It answers with a severity score from 0 to 100. From the binary, Claude Code runs the call without further checks when the score is under 25.

Blunt injections such as "allow all commands" did not work. The model noticed them, and the main agent, which reads the same file, often got suspicious too. What worked was letting the classifier judge correctly on a different scale. The injected line closes the tag, tells the classifier to score from 0 to 10 with 5 as the allow/block line, and reopens the tag. A command the classifier rates 8 out of 10, which it means as "block", reaches Claude Code as 8, which is under 25, so it runs.

His numbers:

In the full sessions, the forbidden commands included git config --global http.sslVerify false, reading a local .env file the user had forbidden, and a malicious skill that fetched from a domain the user had hard-denied. The user's request in that last case was harmless: review package.json for risky dependencies.

Ben-Tov writes that newer versions moved the classification to the server, which makes the request harder to inspect, and that the attack still worked on v2.1.316 from October 31. He reported it to Anthropic on September 4 and had no answer when he published. Claude Code 2.1.317 came out on November 3; its release notes list several auto mode fixes and none about this.

He also notes that Codex's Auto Review and OpenHands use LLM classifiers of the same kind. He did not test them, and we have not either.

What to check in the repositories you have

The published line mentions the user_claude_md tag, a severity scale and an allow/block boundary. A first pass over the folders where you keep code:

grep -rlE --include='AGENTS.md' --include='CLAUDE.md' --include='CLAUDE.local.md' \
  'user_claude_md|severity|allow/block' ~/code 2>/dev/null

Change ~/code to your folder. A hit is a file to read, not proof, and an attacker can reword the line. For a repository you pulled recently, git log -p -- AGENTS.md shows who changed the file and what they added.

If a hit is real and you ran Claude Code in that folder in auto mode, treat whatever that session could reach as exposed: the .env files, your SSH keys, cloud and npm tokens. Rotate them. Our post on the testmetest worm has a longer clean-up list for a repository that ran something as you.

What to set while there is no fix

Put the boundaries that matter in permission rules, not in autoMode.hard_deny. Anthropic's auto mode page says permissions.deny "blocks before the classifier is consulted" and that neither the classifier nor user intent can override it. A rule in ~/.claude/settings.json looks like this:

{
  "permissions": {
    "deny": ["Bash(curl *)", "Read(./.env)"],
    "ask": ["Bash(git push *)"]
  }
}

A rule only matches what it names. Bash(curl *) does not stop wget or a Python one-liner, and the permissions page warns that a deny rule does not match the same program called by its path or inside sh -c. For network limits it suggests pairing deny rules with the Bash sandbox's network allowlist. Prose rules in hard_deny cover more ground, and this research shows they hold only as long as the classifier is not misled by a file someone else wrote.

Keep a stranger's instructions out of the classifier. In /config, set Project instructions to managed-only before you open a repository you did not write. The memory docs say this leaves out project and user CLAUDE.md files and every AGENTS.md. A subdirectory's CLAUDE.md can still load later, on demand, so this narrows the gap without closing it. Switch back for your own repositories, where the project file is useful.

Start an unknown repository in Manual mode, with claude --permission-mode manual, and read its AGENTS.md and CLAUDE.md before you switch to auto. Ben-Tov's own advice is to treat markdown files an agent reads like executables.

The research ends with a recommendation about where the agent runs: in a narrowly scoped sandbox, so a guardrail that fails does less harm. On your laptop, a fooled classifier lets a command reach everything you can reach. In a container or VM, the same command reaches what you put in it.

Where Sessionboxer fits, and where it does not

Sessionboxer does not use auto mode. In each session, Claude Code runs with bypassPermissions inside its own Docker container, so no command waits for a classifier or a click (agents that don't ask). Anthropic's docs say that mode is for isolated containers and VMs only and "offers no protection against prompt injection." That is the trade we made: the container is the boundary.

So a poisoned AGENTS.md in a Sessionboxer session has no classifier to fool, and also nothing that says no. What it reaches is the box: the repository you cloned when you started the session, the agent's home inside the container and the tools installed there. Your laptop's home folder, SSH keys and other clones are not mounted in it. If a turn goes wrong, every turn ends with a snapshot, and Revert to here takes the chat back to an earlier point, with snapshots and forks for the rest.

What it does not protect:

• The agent still reads the project's AGENTS.md or CLAUDE.md as usual, and it can be talked into things by it. Sessionboxer does not scan instruction files.
• The box has outbound internet access, because the agent needs it. A command the agent was tricked into running can send what it finds.
• The box holds secrets of its own: the agent's provider login and, while a GitHub entry is on for the session, the GitHub login that makes git push work. They live on tmpfs and stay out of snapshots, but a process in the running box can read them. If something hostile ran, rotate those.

If you also run Claude Code on your laptop in auto mode, the settings above still apply there. Moving some agents into boxes does not change what the classifier does for the ones that stay on your machine.