Skip to main content

​
How we approach security

​
Security foundation

Your code’s security is paramount. Claude Code is built with security at its core, developed according to Anthropic’s comprehensive security program. Learn more and access resources (SOC 2 Type 2 report, ISO 27001 certificate, etc.) at Anthropic Trust Center.

​
Permission-based architecture

A session’s permission mode sets which actions Claude can take without asking you first. Auto mode is the built-in starting permission mode for interactive terminal and VS Code sessions. Which mode a session starts in covers earlier versions, other surfaces, and the settings that change the starting permission mode.
  • Auto mode: A separate classifier model reviews actions instead of you and blocks the ones it judges unsafe. How the classifier evaluates actions lists which actions Claude Code approves outright, which it sends to the classifier, and which Claude Code still asks you about. Your explicit ask and deny rules still apply, and your organization can turn auto mode off
  • Manual mode: Claude Code starts with read-only permissions. When it needs to edit files, run tests, or execute commands, it asks you first, and you choose whether to approve the action once or allow it from then on. It runs a built-in set of read-only commands such as ls, cat, and git status without asking
You and your organization configure these permissions directly. For detailed permission configuration, see Permissions.

​
Built-in protections

To mitigate risks in agentic systems:
  • Sandboxed bash tool: Sandbox bash commands with filesystem and network isolation, reducing permission prompts while maintaining security. Configure with /sandbox to define boundaries where Claude Code can work autonomously
  • Working directory boundary: In Manual mode, Claude Code asks you before its file tools read or write outside the folder where it was started and its subfolders. The boundary is a permission prompt, so a Bash command you approve can still write anywhere your user account can
  • Prompt fatigue mitigation: Support for allowlisting frequently used safe commands per-user, per-codebase, or per-organization
  • Accept Edits mode: Auto-approves file edits and a fixed set of filesystem Bash commands like mkdir, touch, rm, mv, cp, and sed for paths in the working directory. Other Bash commands and out-of-scope paths still prompt

​