Hey, this is Sabatino from the future and before we talk about bypass permission mode, the anthropic team has shipped an update to the permission system which I briefly wanted to talk about. Anthropic introduced a new permission mode called Auto mode. Auto mode is currently in research preview and at the time of this recording it's only available on team plans not on the max plan but nonetheless let's briefly take a look. We ended last lesson with this specific pre-tool use hook where we pass or

not on the max plan but nonetheless let's briefly take a look. We ended last lesson with this specific pre-tool use hook where we pass or request on to cloud itself by running it in print mode and we pass in a prompt in which we say to scan the incoming request and decide whether or not to allow it. Little did we know at the time this is basically Auto mode. Let me show you. To enable Auto mode you have to run cloud as just enable Auto mode and then we get access to its new Auto mode as we can see here. I'm currently in one of

mode and then we get access to its new Auto mode as we can see here. I'm currently in one of my own projects because when I run cloud Auto mode in another project it doesn't seem to work so it's still pretty buggy it is a research preview after all. We're logged in to a team plan and at the time of this recording this only works on a team plan not on a max plan. As you can see here I'm locked into a team plan and at the time of this recording this only works on a team

see here I'm locked into a team plan and at the time of this recording this only works on a team plan not on the max plan and as we can see here Auto mode is on and now when we try and bait the model for example we can say crawl lara casts.com as you can see here we didn't get a permission request and it got Auto allowed by the Auto mode classifier. This request got handed off to a specific classifier model which evaluated this as safe and it accepted the request and this works

specific classifier model which evaluated this as safe and it accepted the request and this works just like our pre-tool use hook did. As far as I understand the classifier is a dedicated model that's based on sonnet 4.6 so this does introduce some latency and extra token usage. There are a few smart things built in for example when running in Auto mode cloud code will drop any rule in the allow list that allows for blanket shell access. So even though we have bash, bash python and

allow list that allows for blanket shell access. So even though we have bash, bash python and bash node in here this will be ignored in Auto mode. They also strip out tool use results so the prompt injection risk from external sites is greatly reduced. Finally they also block things like deployments, modifying infrastructure and other destructive or irreversible actions. In the context of running unattended railfloops this permission mode sounds pretty interesting

In the context of running unattended railfloops this permission mode sounds pretty interesting because it truly balances model freedom with safety. However in my few days of experimenting with it the classifier model was unavailable multiple times throughout the day leading to stalled railfloops. When Auto mode fails it tries to fall back to regular permission mode which is unavailable in print mode and as we saw earlier even though we ran cloud with

which is unavailable in print mode and as we saw earlier even though we ran cloud with enable Auto mode and we're on the teams plan Auto mode simply will not start in our example repository and we get a message that Auto mode is temporarily unavailable. Books and flakiness aside this is a very interesting new permission mode with high potential. I recommend you keep an eye on it but for now let's move on to safely bypassing the entire permission system in the next lesson.

the entire permission system in the next lesson.