Tip: Claude Code Auto Mode's Dual-Layer Defense Architecture — Sonnet 4.6 Classifier Details

Anthropic·medium signal

Auto mode uses two independent defense layers regardless of which model your main session runs. Layer 1 (input): a server-side prompt-injection probe scans tool outputs before they enter the agent's context. Layer 2 (output): a Sonnet 4.6 transcript classifier evaluates each pending action against three criteria — scope escalation (is Claude exceeding the task?), untrusted infrastructure (unknown target systems?), and prompt injection (hostile content driving the action?). The classifier always runs on Sonnet 4.6, even if your session uses Opus. Understanding this architecture helps you predict when auto mode will block vs. allow.