Locking Down AI Auto Mode and Read Access

James Turner

So, picture this. You set an AI coding agent loose in auto mode, right? You tell it to fix a bug in your web app, you grab a coffee, and while you're away... it starts reading files from your root directory. Or grabbing your personal cloud keys from somewhere else on disk.

Lachlan Reed

Yeah, nah, that is... that is terrifying, mate. Like leaving a tradesman to fix a leaky tap in the bathroom and coming home to find him digging through your bedroom nightstand.

James Turner

Exactly! And until version 2 point 1 point 257 of Claude Code... brought to you by Jellypod AI... auto mode actually let that happen! It auto approved plain file reads anywhere on your machine.

Lachlan Reed

Wait, seriously? So it didn't even... it didn't even ask if it wandered outside the project folder?

James Turner

Nope! Auto mode's classifier was built to stop big destructive stuff, like force pushing to main or dropping a database. But reading a file? It just let it slide. So if an injected prompt inside a dependency told Claude to go inspect a file in another directory, it would just do it.

Lachlan Reed

Crikey. That is a massive blind spot for prompt injection, hey?

James Turner

Huge. But in version 2 point 1 point 257, they added out of bounds read protection. The very first time Claude calls tools like Read, Grep, or Glob on a path outside your active working directory, it halts and gives you a one time prompt.

Lachlan Reed

Right, right, so... so it hits a boundary and goes, hey mate, am I allowed out here?

James Turner

Right! And if you click Block from now on, it writes a line to your settings file... permissions dot blockReadsOutsideWorkingDirectories set to true.

Lachlan Reed

Ah, beautiful! And once that setting is locked in, it's a standing block across all your sessions and permission modes, yeah?

James Turner

Exactly. Unless you explicitly bring that path into scope. Like, if you actually need Claude to look at a sibling project, you can just run slash add dir and give it the folder path, or add it to your JSON settings under additionalDirectories.

Lachlan Reed

Now, wait on, what about headless runs? Like when I run Claude in a CI CD pipeline with the minus p flag, or when a background subagent is running where no human can click a pop up?

James Turner

That is the crucial part. In non interactive runs, if it tries to read outside the working directory and you haven't pre approved it in your user settings file, it doesn't wait... it just blocks it strictly. So setting permissions dot blockReadsOutsideWorkingDirectories in your user config is basically mandatory for CI stability.

Lachlan Reed

That makes total sense. Prevent your automated builds from hanging or leaking secrets. Now, didn't they also tighten up cloud metadata endpoints in the same release?

James Turner

Oh yeah! They added Containment Escape rules. Auto mode used to be a little too trusting if a malicious package tried to reach out to local cloud metadata services... like the AWS endpoint at 169 dot 254 dot 169 dot 254.

Lachlan Reed

Ah, the classic IMDS credential fetch trick! Sneaky buggers try to grab instance role tokens.

James Turner

Yep! Now, any request targeting cloud metadata, or attempting egress evasion, or trying to reach across tenant boundaries is blocked cold. It won't auto approve those anymore, period.

Lachlan Reed

Man, that gives me a lot more peace of mind running auto mode while I go make a tea. Now, speaking of minor developer wins, didn't they touch up the terminal controls recently too?

James Turner

Oh, version 2 point 1 point 261! Yes! If you spend all day typing in the terminal, you'll love this. Word editing shortcuts now strictly match native Bash behavior.

Lachlan Reed

Oh, tell me Ctrl W actually deletes back to whitespace now!

James Turner

It does! Ctrl W deletes back to whitespace, and Alt F and Alt D jump or delete to word boundaries cleanly, using punctuation as delimiters. They completely retired the old keybindingFlavor setting because standard Bash style is now the default everywhere.

Lachlan Reed

Good riddance! Trying to edit a long prompt with weird keybindings felt like steering a shopping trolley with a broken wheel. What about proxy diagnostics? I know a few enterprise dev mates who get stuck behind corporate firewalls.

James Turner

Right, so in 2 point 1 point 261, when your org policy fails to load, running status or claude doctor gives you the exact reason. Like if a corporate proxy stripped an endpoint header, it actually tells you instead of just failing silently.

Lachlan Reed

And timestamps in session transcripts! Did I see 2 point 1 point 257 added custom time formats?

James Turner

It did! You can set timeFormat and timeZone in settings for 12 hour, 24 hour UTC, or full strftime patterns on your transcript clocks.

Lachlan Reed

Fantastic. So tighter security, better terminal muscle memory, and clearer logs. Not a bad set of updates at all, mate.

James Turner

Not at all. Lock down those working directories, and let the agent do the work!