Instead of one-off fixes Claude should have a much richer interface to configure between "ask approval every time" and "YOLO dangerously". I should be able to trivially set "run this task until completed" and have settings like: don't consult the web, don't touch files outside of the codebase, don't delete anything, etc. They don't have to be perfect, just better than the all or nothing system we have now.
Codex legit does a great job of this with it's auto-review feature. Does a good job of understanding what permissions I'm implicitly giving with the request, and where it needs to actually ask me to grant permission.
automode mostly fixes these things, it runs a classifier on every request that would have required permissions to make sure it matches your request
Until the classifier is wrong or also prompt injected. the classifier is just as vulnerable as the model itself is. Yes it is harder to break but trying to make a nondeterministic tool deterministic by adding another nondeterministic one on top just reduces the chance of something going wrong.
Tbf as long as that chance is low enough it doesn't matter in practice, but I have definitely seen the classifier approve things that were questionable, and I've also seen it decline things that were obviously okay.
It would be nice to use automode in planning mode.
Right now planning mode (e.g. I want claude to do all the planning necessary to create a robust plan file) still prompts you with trivial things, especially one-off things you wouldn't care to add to your whitelist. Yet if you switch into automode, then it's not in planning mode anymore.
Repro:
1. Prompt "Implement a hello world in C" in planning mode
2. Switch to automode
3. It writes hello.c instead of a plan file
I feel like this could be solved with an NLP interface to SELinux, spinning up policies on the fly, blocking network access or giving read only permissions on a per-conversation basis.
At least there's an auto-approval mode now that uses another agent to sanity check commands. Before it, the options really were manual vs yolo.
This is by design. Anthropic treat users as paying workers (how futuristic!). Their end game is to replace software developers (and it's not like they are trying to hide that?)