Claude does clearly stupid things, even under auto mode, that no human would reasonably do. I had a sustained 500mb/s ingress to my machine that turned out to be a background "find /" command on a multi-petabyte NFS system. I've now gotten serious about my deny lists, and it trips all the time.

The worst is when it works around the deny list by running an equivalent command like "bfs /" or just writes itself a script.

I wish we would get better sandboxing than more "safeguards", but the direction things are going seems inspired by craw.

I've used auto mode a few times and it's honestly pretty good, but I think this isn't just about auto mode, CC in particular has many other safeguards I've noticed even when not under auto mode (one that surprised me recently is a "risky command detected" that under bypass permissions stopped a tool call - the script had a RM /$var - had the var been empty somehow, it could've deleted the os).

I'm not surprised they are confident in promoting it to the default, it alongside the many other safety features in the tooling are honestly probably better than my exhausted review of every action.

Auto mode denies are also interesting, sometimes Claude wants to go off script to double check something (ie: waste time checking something slightly related that I know is not necessary/truth holds) and auto mode plainly stops it since it's off scope, nice bonus.

Auto mode is already appearing on claude.claude advised us to use sonnet 4.6 for deep coding with less tokens used