A new prompt dump puts Claude Code's auto mode under scrutiny

A community prompt collection has published what it says is the rulebook behind Claude Code’s auto-mode safety classifier. The System Prompts Leaks repository added the document on November 3 at 05:03:46 UTC and describes it as a 139 KB prompt sent to Sonnet 5. That provenance and model identification are the repository’s claims; AITrending verified the public addition and inspected the English document, but has not independently reproduced its extraction or authenticated it with Anthropic.

The interesting part is the boundary the document draws around autonomous work. Its opening describes a monitor for coding agents with shell access, files and API credentials, running tasks while the user may be away. It identifies prompt injection, work expanding beyond the user’s task and accidental damage to shared resources as the main risks.

A permission rulebook, not a quality judge

The posted text divides restrictions into hard security boundaries and softer blocks that sufficiently specific user authorization can clear. It asks the classifier to consider the latest tool call together with earlier file edits and any later effects that the call would enable. A harmless-looking command is therefore not supposed to erase the significance of code written earlier in the conversation.

It also distinguishes a user’s instructions from quoted material, repository files, tool output and messages from other agents. For developers trying to understand why an automated action stops, that distinction is more consequential than a simple list of forbidden commands: the claimed rules depend on where an instruction came from, which resource it names and what the action ultimately changes or sends.

The document explicitly limits the classifier’s scope to destructive, difficult-to-reverse or security-related actions. Bad answers, wasted work and fabricated results are described as outside that scope. Even if the text accurately represents a deployed classifier, permission to execute would not certify that an agent’s work is correct.

What the public documentation confirms

Anthropic’s English auto-mode configuration guide independently describes routing tool calls through a classifier and distinguishes hard-deny rules, soft-deny rules, allow exceptions and environment context. It documents ways to inspect effective configuration and explains that narrow shell allow rules can resolve before classifier review unless broader shell classification is enabled.

That supports the general mechanism, not the authenticity or universal deployment of this particular file. Auto mode is an existing feature; today’s event is the community publication of a purported internal prompt. The document is available to read on GitHub without installing anything, and its source commit makes the newly added material identifiable.

For coding-agent builders, the dump provides a concrete artifact to examine when discussing consent, task boundaries and delayed effects. It supplies neither a measured safety benchmark nor evidence of a successful bypass. AITrending has not tested the classifier’s behavior, and the repository’s labeling should remain attached to claims about its origin.