Let's start honest: auto mode is the right way to use a coding agent. Approving every ls by hand turns a colleague into a form you have to keep signing. The productivity is real, we run our own agents in auto mode daily, on machines we care about.
But it is worth being precise about what you switched off. In auto mode, the agent executes shell commands with your permissions, your SSH keys in reach, your cloud credentials in the environment, and no human between a decision and its execution. The model is excellent. The question is never the model. It is everything the model reads.
The part that isn't hypothetical
An agent in auto mode acts on what enters its context: your prompt, plus files it opens, pages it fetches, dependencies it reads, tickets it processes, tool output it receives. Any of those can carry instructions. Researchers keep demonstrating the same chain, poisoned README to exfiltrated credentials, because the chain is structural: input becomes intent, intent becomes a shell command, and in auto mode the shell command becomes reality without a checkpoint.
We wrote up the full anatomy in what happens when an AI agent gets hacked. The short version: once the context is poisoned, the agent doesn't feel hacked. It feels helpful.
Keep the speed. Add a floor.
The fix is not going back to approving every command, it is moving the checkpoint out of the conversation. A runtime guardrail sits outside the agent's process and screens what actually runs: normal work flows untouched at full speed, dangerous commands get denied or held for you, and on Linux the kernel itself can refuse unauthorized binaries, a wall that exists whether or not the model remembers its instructions.
For Claude Code specifically, InnerWarden hooks in as a PreToolUse check: every proposed shell command is screened in-process, offline, before it executes, with verdicts and an audit trail that stay on your machine. Install takes one command, starts in watch mode so day one is pure signal, and you decide if and when enforcement turns on. Setup lives in the integrations quickstart.
Auto mode with a floor under it is not a compromise. It is the configuration where you stop having to choose between a useful agent and a machine you trust.