What is the difference between auto mode and bypassPermissions in Claude Code?

What it does

Both modes end the routine prompts. They differ in what takes the prompt's place.

claude --permission-mode auto

A second model, the classifier, reads each action before it runs and blocks the ones that escalate beyond your request, reach infrastructure it does not recognise, or look driven by content Claude read somewhere. A blocked action is not the end of it: Claude is told why and tries another route, and the action waits in /permissions under Recently denied, where r retries it with your manual approval.

claude --permission-mode bypassPermissions

Nothing reads the action. It runs. That includes the writes every other mode holds back, such as .git, .claude and your shell rc files, and the operations the classifier blocks by default: force pushes, production deploys, piping a download straight into a shell.

The short list of things that interrupt Claude in *every* mode, explicit ask rules and MCP tools that require interaction among them, is the same for both. It lives on the bypassPermissions page.

--dangerously-skip-permissions is not a third option. It is the same mode under another name, so "auto vs dangerously-skip-permissions" is this comparison.

When to use it

The question that separates them is what stops a wrong action. In auto mode the answer is the classifier. In bypassPermissions the answer is the wall of the container the session runs in, and if there is no container, the answer is nothing.

So auto mode is for your own machine: a task you have scoped, a repository you own, sessions where prompt fatigue is the real risk. On Pro, Max and Team plans you are already in it; the terminal starts there.

bypassPermissions is for the case the documentation names, a disposable container or VM, and specifically for runs where a block would be worse than a mistake. In CI nobody is there to answer a prompt, and the classifier's round-trip before each shell command costs time and, on Enterprise and API accounts, tokens. Anthropic's own row for "run fully unattended inside a container" is a -p run with --dangerously-skip-permissions, with isolation listed as required rather than recommended.

acceptEdits sits below both. It auto-approves file edits and a small set of filesystem commands, and every command beyond the built-in read-only set still prompts. Pick it when you want to read the diff afterwards but still approve commands yourself.

Example

What a blocked action looks like in auto mode, from v2.1.208 on:

Blocked by classifier

Open /permissions, go to Recently denied, and press r to run it with a manual approval. If the same kind of action keeps getting blocked, a narrow allow rule for the exact command skips the classifier for it:

{
  "permissions": {
    "allow": ["Bash(./scripts/deploy-staging.sh)"]
  }
}

In bypassPermissions the same action simply runs. The one checkpoint you can keep is an ask rule, which prompts in every mode:

{
  "permissions": {
    "ask": ["Bash(git push *)"]
  }
}

In an interactive session that prompt appears even with permissions bypassed. In a -p run there is nobody to answer it, so the push is denied instead.

Security considerations

The documentation says it in one line: bypassPermissions offers no protection against prompt injection or unintended actions, and for background safety checks with far fewer prompts, use auto mode instead.

The classifier is built for exactly the injection case. It sees your messages, the tool calls and your CLAUDE.md, but tool results are stripped, so hostile text in a file or a web page cannot address it directly. It is still a model making a judgement, and the auto mode page covers what that judgement lets through.

One consequence of the hierarchy is worth knowing: in auto mode, launching an agent loop with --dangerously-skip-permissions is on the classifier's blocked list. Auto mode will not quietly hand its work to bypass.

Common mistakes

Reaching for bypassPermissions because auto mode blocked something. A block is one action, and it is retryable from Recently denied. Repeated blocks usually mean the classifier lacks context about your infrastructure, which an administrator can supply through autoMode.environment. Switching to bypass fixes the block by removing every other check with it.

Assuming the two are far apart in the cycle. When both are enabled, the Shift+Tab order after plan is bypassPermissions first, then auto. Press once too few on the way to auto and you are in bypass, with the status bar as the only difference.

Treating the classifier as a substitute for a container. It reviews actions; it does not contain them. If the session can reach production credentials, auto mode is a filter in front of them, not a wall. That is a reason to isolate, not a reason to switch to bypass.

Related questions

• What is auto permission mode in Claude Code?
• Why is auto mode blocking my command?
• How do I run Claude Code with bypassPermissions?
• What does acceptEdits allow?
• What is the difference between --dangerously-skip-permissions and bypassPermissions?