News for hackers. Stuff that matters.

A comment on Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files. Parent comment

Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by 80fj0348i on Saturday November 07, 2026 @04:43PM (#50408322)
I and other colleagues have been struggling with auto mode refusing perfectly safe commands in our environment, so we frequently find ourselves switching to the other modes to handhold Claude Code into perfectly safe things like triggering deterministic and guardrailed CI/CD pipelines or read-only queries of production data. Auto mode seems overtuned for caution around deployment and production, which is a regression from how useful Claude Code was for operations around June/July. Until that's improved, permission rules are incredibly important to our workflows.
[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by bcherny on Saturday November 07, 2026 @04:56PM (#50408416)
Yeah, by default we err on the side of caution. That said, the auto mode classifier is fully customizable based on your team’s usage. Two ways to tune it:

1. After a command is blocked, run /permissions to retry and allow it going forward

2. More deeply configure the classifier itself: https://code.claude.com/docs/en/auto-mode-config

We are working on making these easier and more automated.

[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by written-beyond on Saturday November 07, 2026 @05:05PM (#50408490)
Auto mode really easily gaslights itself when it runs into a roadblock and starts deviating so far away from its intended goal that I don't let automode run without me reading what it's actually trying.

I frequently hit stop on and auto mode task to prevent it from completely flooding my context with some completely unrelated garbage.

Claude really should push away tasks that end up needing more exploration in worker contexts. That way the workers can maintain a sensible amount of context without pushing the main chat into the dumb region.

[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by skeledrew on Saturday November 07, 2026 @06:01PM (#50408877)
You should note that auto-mode is handled by a different session (and likely model) from your actual. There's no road block or deviation or context flooding; all it does is monitor the model actually doing the work and block it from potentially problematic actions (which you can usually override by saying you explicitly give permission for X), nothing more.
[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by bulder on Saturday November 07, 2026 @06:26PM (#50409021)
The context pollution happens when a denial triggers but the model still keeps attempting the harmful action via alternative avenues. It's got nothing to do with the auto-mode eval model's actual output.
[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by skeledrew on Sunday November 08, 2026 @07:51AM (#50412826)
I have never seen that happen before. What I see is a mention that the classifier stopped it from doing X and it then asks for explicit permission or gives me the command to run myself.
[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by kay_o on Saturday November 07, 2026 @06:03PM (#50408897)
For some reason claude code hates using the read/write/grep tools and defaults to complex sed, awk, grep Bash:* runs which results in always consistently ignoring auto mode due to the classifier not knowing what to do with a 10-line long bash pipe instead of a read + pre/post read and write hooks being ignored and not firing, what is up with that?
[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by dcrazy on Saturday November 07, 2026 @06:29PM (#50409043)
I use a hook to deny `grep /` and `find /`.
[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by awfulneutral on Saturday November 07, 2026 @06:43PM (#50409124)
I had claude write a hook to deny `find /`. It tested it thoroughly. Much later I learned that the hook denied `find /` but allowed everything else that existing permissions denied, like running whatever random python/bash code it wanted without asking.
[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by awfulneutral on Saturday November 07, 2026 @06:48PM (#50409151)
I don't understand this either, it makes commands really hard to parse. It seems like 90% of what claude does could be going through some mcp tool that could be easily sandboxed instead of bash gibberish.
[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by kay_o on Saturday November 07, 2026 @07:09PM (#50409288)
If it was human approval ? Read("./file.name") then Bash("docker compose run unit-tests"), sure, I can read that fine !

As I was reading your post I got another approval request that auto-mode did not understand. It was a single Bash call !!23!! lines tall on a retina mac display with six different variables. If anything this is the cause of approval fatigue and auto mode does nothing helpful when this is every call. I also have in my claude.md and global instructions to use tool calls rather than bash grep/cat/find, which are disregarded.

[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by awfulneutral on Saturday November 07, 2026 @07:49PM (#50409512)
Yeah I agree, I didn't used to feel approval fatigue but lately the huge bash chains are giving it to me. I haven't even tried auto mode. I'm just sure it has some definition of "safe" that does not align with my own.
[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by kay_o on Saturday November 07, 2026 @08:30PM (#50409720)
I'm not sure when claude started preferring huge bash chains but auto mode tends to decline most of them and drop to a permission prompt -- getting rid of the use of auto mode -- because it refuses to handle anything chained with expansions, variables or similar items
[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by rsynnott on Sunday November 08, 2026 @04:36AM (#50411726)
> perfectly safe things like triggering deterministic and guardrailed CI/CD pipelines or read-only queries of production data

I... question whether the second one is perfectly safe.

[ Parent | on HN ]