Willison won't call Claude Code's auto mode safe

Simon Willison endorsed Anthropic's case for auto mode in Claude Code on August 8, then refused to call it safe.

The gap matters for teams running Claude Code unattended. Anthropic's case for auto mode rests on 72 scripted test scenarios. Willison's worry is the one those scenarios can't catch: a hostile package with no human watching.

He agrees with the underlying argument. "Asking humans to click OK every few steps is clearly not going to result in safe behavior," he wrote. But he won't sign off on the fix. "I would love to believe that Anthropic have indeed solved this problem for Claude Code users," he wrote, and left it there.

Willison's specific worry is malicious third-party packages that look credible to the model, the exact failure scripted scenarios can't surface. My read: a convincing fake isn't something you can write a test case for before you've seen it.

He's also predicted a coding-agent security disaster sometime in 2026, and he wants outside verification before accepting Anthropic's numbers at face value. He's not alone in that instinct.