Plan mode and auto mode are not a safety slider with one setting for safe and another for fast. They are two different workflows designed for two different risk profiles.
Getting this distinction right is one of the highest-leverage habits in Claude Code.
Using the wrong mode for the task either slows you down unnecessarily or lets the agent make changes you cannot predict.
Key takeaways
- Plan mode blocks all file writes: Claude reads, analyzes, and produces a numbered plan. No source file is touched until you approve.
- Auto mode is not
--dangerously-skip-permissions: It sits between default and bypass. A built-in classifier reviews each tool call before execution and blocks risky actions. - Auto mode launched March 24, 2026: Research preview for Team plan users; rolled out to Pro subscribers in week 21.
- Three permission modes exist: Default → Auto-Accept Edits → Plan. Shift+Tab cycles through them in order.
- The right pattern: Start in plan mode for any complex, high-stakes, or unfamiliar task. Switch to auto mode once the plan is approved and subsequent steps are well-scoped.
- Ultraplan (April 2026): An extended planning workflow that runs deeper context analysis and produces a more granular plan for large-scale tasks.
What default mode actually does
Before comparing plan and auto modes, it helps to understand where Claude Code starts.
Default mode is Claude Code’s baseline. It executes an internal reasoning loop: thinks through the task, identifies actions, executes them, observes results, and iterates.
It asks for explicit approval before file edits and shell commands that could modify system state.
Default mode is faster than plan mode for simple tasks and safer than auto mode for anything unfamiliar. It is the right starting point for most work.
What plan mode does
Plan mode changes the contract between you and Claude Code. Instead of executing while asking for individual approvals, Claude Code reads, thinks, and writes a plan first. No file is touched until you say go. The cost of rejecting a wrong plan is zero because nothing has been modified.
Plan mode is a hard constraint. Write tools are physically blocked when plan mode is active. Shell commands that change state are also blocked.
Read operations (file reads, git status, test runs, searches) are permitted because they have no side effects.
What you see in plan mode:
Claude Code reads the relevant files, maps dependencies, and produces a numbered plain-English plan listing:
- Every file it intends to change
- Every command it intends to run
- Every risk it identifies
- The logic behind each proposed action
You read the plan, push back on anything wrong, approve or reject, and then execution begins. If you reject the plan, nothing has happened. No rollback required.
When to use plan mode:
- Multi-file refactors touching three or more files
- Schema changes or database migrations
- Unfamiliar codebases where you have not yet built trust with Claude Code’s understanding
- Security-sensitive code changes
- Any change where the “almost right” failure mode would be expensive to debug
- Security audits and code review (analysis without modification risk)
What auto mode does
Auto mode is a distinct middle ground between default and bypass mode. Understanding what makes it different from both is important before enabling it.
Auto mode is not removing safety controls. It is delegating safety decisions to a built-in classifier that evaluates each tool call before execution. Safe actions proceed automatically. Risky actions get blocked and force Claude to find another approach.
Anthropic launched auto mode on March 24, 2026 to address a persistent friction point: Claude Code’s default requires human approval for every file write and shell command.
The alternative before auto mode was --dangerously-skip-permissions, which removes all checks entirely.
How auto mode’s classifier works:
Every tool call Claude Code wants to make passes through a classifier that scans for red flags:
- Mass file deletions
- Data exfiltration attempts
- Malicious code execution patterns
- Actions outside the expected task scope
Safe actions proceed without prompting. Risky actions get blocked, and Claude is forced to find a different approach.
If Claude is repeatedly blocked on an action, it eventually surfaces a prompt to the human operator rather than getting stuck.
The difference from --dangerously-skip-permissions:
Bypass mode (--dangerously-skip-permissions) removes all oversight. Every action executes regardless of risk.
Auto mode retains classifier-based oversight on every action. The two modes are not on the same spectrum; they are categorically different safety postures.
When to use auto mode:
- Clear, bounded tasks on a codebase you understand well
- Trusted, repetitive workflows where you have already reviewed the pattern
- Long unattended sessions where constant approval prompts would interrupt the work
- Tasks you would manually review by examining the git diff afterward rather than approving each step
The four permission modes
In 2026, Claude Code has four permission modes, not just two.
| Mode | What it does | When to use |
|---|---|---|
| Default | Asks for approval before file edits and shell commands that modify state | General use; unfamiliar tasks |
| Auto-Accept Edits | Auto-approves file edits; still asks for other commands | When you trust the edit pattern but want to review commands |
| Plan | Blocks all writes; produces a reviewable plan first | High-stakes, complex, or unfamiliar tasks |
Bypass (--dangerously-skip-permissions) | Disables all oversight | Isolated containers only; never in CI/CD with external input |
Auto mode as released March 2026 is what the documentation calls “auto-accept” in the permission mode cycle.
The classifier-based safety layer applies to all non-plan modes where actions proceed without explicit human approval.
How to activate each mode
Switching mid-session with Shift+Tab:
Press Shift+Tab to cycle through permission modes in order: Default → Auto-Accept → Plan → Default. Two presses from default lands on plan mode.
The status bar shows the current mode: you will see “plan mode on” or the equivalent indicator.
The /plan slash command:
Type /plan at the start of any prompt to enter plan mode for that single prompt only.
Claude produces a plan for that specific task without switching the entire session into plan mode. Useful for a one-off complex step inside an otherwise default-mode session.
Session flags at startup:
# Start entire session in plan mode
claude --permission-mode plan
# Headless plan mode for scripts and CI
claude --print --permission-mode plan "describe the task"The headless flag (--print) produces a plan without entering an interactive session. Useful for CI workflows where you want a plan produced for human review before any automated execution.
Enabling auto mode:
Auto mode availability depends on your plan. As of June 2026:
- Claude Max subscribers: available (shipped in v2.1.111)
- Claude Pro subscribers: available (rolled out week 21, 2026)
- Team and Enterprise: requires admin to enable first; admins can lock it off with
permissions.disableAutoMode: "disable"in managed settings - Older models (Sonnet 4.5, Haiku): not supported; requires Claude Opus 4.6 or later
Ultraplan: extended planning for large-scale tasks
In April 2026, Anthropic introduced Ultraplan as an extended planning workflow within plan mode.
Ultraplan runs a deeper context analysis than standard plan mode and produces a more granular, multi-level plan for large-scale tasks.
Where standard plan mode produces a numbered list of file changes, Ultraplan breaks work into phases, identifies dependencies, surfaces higher-order risks, and produces a plan that reads more like an architecture document.
Use Ultraplan for:
- Large-scale refactors touching dozens of files
- Major architectural changes with significant dependency chains
- Tasks where understanding the interdependencies between changes is as important as the individual changes themselves
Decision framework: which mode for which task
| Task type | Recommended mode | Why |
|---|---|---|
| First task in an unfamiliar codebase | Plan mode | Claude may not fully understand the codebase yet; a plan reveals its assumptions |
| Multi-file refactor (3+ files) | Plan mode | Scope uncertainty; plan lets you validate before any file is touched |
| Schema or database migration | Plan mode | Irreversible changes; plan lets you catch issues before execution |
| Security review or code audit | Plan mode | Analysis without modification risk |
| Trusted, bounded feature addition | Default or auto mode | Well-scoped; you understand what Claude should do |
| Repetitive formatting or linting | Auto mode | Pattern is known; interruption reduces value |
| Long unattended session on known codebase | Auto mode | Classifier handles safety; you review the diff when done |
| Untrusted repository or external code | Plan mode | CVE-2025-59536 demonstrated that malicious hooks can execute in untrusted repos |
| CI/CD pipeline with external input | Never use bypass; plan or default only | External input is a prompt injection risk |
The productive pattern: start in plan, shift to auto
The most effective Claude Code sessions combine both modes within a single project.
Recommended session pattern:
- Start in plan mode for the first, highest-uncertainty action of the session
- Review the plan and validate that Claude Code understands the codebase correctly
- Approve and execute the plan
- Shift to auto mode (Shift+Tab) for subsequent bounded steps where the plan has already confirmed Claude Code’s understanding
- Return to plan mode (Shift+Tab again) when the next task has a large scope or unfamiliar territory
This pattern preserves speed without sacrificing safety on the first, highest-uncertainty action.
The plan on step one validates that Claude Code has the right mental model of your codebase. Once confirmed, subsequent steps can run faster without the same risk.
The difference between plan mode and auto mode is the difference between reviewing a surgery plan and waking up after the operation. For high-stakes changes, you want to see the plan.
Need help building safe, productive Claude Code workflows for your team?
Individual workflow habits are learnable. Building a consistent team-wide approach to plan mode, auto mode, hooks, and permission rules across dozens of engineers requires deliberate design.
Phos AI Labs is an embedded AI consulting firm for small and mid-market businesses.
We identify the right AI problems, build the strategy, handle implementation, and train your team until AI is how the business actually runs.
- Strategy before systems: We establish which Claude Code workflows your team should own and what safety controls each requires.
- AI Foundations that hold: We install the operating context, decision rules, and configuration standards your team runs on for years.
- Real team training: We build Claude Code fluency inside your actual engineering workflows, not in staged demos.
- Private AI Workspace: We design a company-wide AI environment built around your knowledge base and existing stack.
- AI-Native Operations design: We rebuild the workflows that matter most so AI compounds across your engineering team.
- Honest judgment, every time: We tell you which mode fits which task and why.
- We stay until it compounds: We are not done when the training is delivered. We are done when the team ships differently.
400+ engagements. Clients include Zapier, Coca-Cola, Medtronic, Dataiku, and American Express.
For certified Claude Code implementation with production-grade workflow design, LOW/CODE Agency is one of the first Anthropic partners worldwide with 10+ CCA-F certified developers on staff.
If you want your Claude Code workflows to hold in production, talk to the team at Phos AI Labs.
FAQs
What is Claude Code plan mode?
Plan mode blocks all file writes and produces a numbered plan before any file is touched. You approve or reject before execution begins.
What is Claude Code auto mode?
Auto mode lets Claude Code proceed without explicit approval per action, using a built-in classifier to evaluate each tool call. Safe actions execute automatically. Risky ones get blocked. Launched March 24, 2026.
How is auto mode different from --dangerously-skip-permissions?
Auto mode retains classifier-based oversight on every action. Bypass mode removes all oversight. They are categorically different safety postures, not points on the same spectrum.
How do I activate plan mode in Claude Code?
Press Shift+Tab twice mid-session to cycle into plan mode. Type /plan before any prompt for a single-turn plan. Start the session with claude --permission-mode plan to default every prompt to plan mode.
When should I use plan mode vs auto mode?
Plan mode for multi-file refactors, schema changes, unfamiliar codebases, and security-sensitive work. Auto mode for trusted, repetitive, bounded tasks.
Start in plan mode and switch to auto once the first plan validates Claude Code’s understanding.
What is Ultraplan?
Ultraplan is an extended planning workflow (April 2026) that runs deeper context analysis and produces a more granular, multi-level plan.
Best for large-scale refactors and major architectural changes with complex dependency chains.