automode mostly fixes these things, it runs a classifier on every request that would have required permissions to make sure it matches your request
automode mostly fixes these things, it runs a classifier on every request that would have required permissions to make sure it matches your request
Until the classifier is wrong or also prompt injected. the classifier is just as vulnerable as the model itself is. Yes it is harder to break but trying to make a nondeterministic tool deterministic by adding another nondeterministic one on top just reduces the chance of something going wrong.
Tbf as long as that chance is low enough it doesn't matter in practice, but I have definitely seen the classifier approve things that were questionable, and I've also seen it decline things that were obviously okay.
It would be nice to use automode in planning mode.
Right now planning mode (e.g. I want claude to do all the planning necessary to create a robust plan file) still prompts you with trivial things, especially one-off things you wouldn't care to add to your whitelist. Yet if you switch into automode, then it's not in planning mode anymore.
Repro:
1. Prompt "Implement a hello world in C" in planning mode
2. Switch to automode
3. It writes hello.c instead of a plan file