Rules / CFG079

CFG079 autoMode weakens the auto-mode permission classifier

Severity: error (broad allow) · warn (dropped soft_deny defaults) OWASP: LLM03:2026 – Excessive Agency

What cfgaudit checks

When permissions.defaultMode is "auto", Claude Code runs a classifier that decides which actions execute without a confirmation prompt. The autoMode object tunes that classifier — and each of its allow / soft_deny / environment arrays replaces the corresponding built-in classifier section entirely unless the literal string "$defaults" is spliced in as an array entry.

A committed autoMode can therefore silently widen what auto-approves. CFG004 already flags defaultMode: "auto" itself; CFG079 covers the previously-invisible classifier-tuning half. cfgaudit fires when a committed autoMode:

• has a broad allow entry — a bare * / **, or an unrestricted shell grant (Bash, Bash(*), PowerShell(*)). The classifier then auto-approves arbitrary commands. → error
• replaces soft_deny without "$defaults" — the soft_deny array is present but does not include "$defaults", so the built-in deny baseline is dropped (an explicit empty array counts — it replaces the defaults with nothing). → warn

The finding fires whether or not defaultMode: "auto" is currently set: a committed weakened autoMode is latent excessive agency that takes effect as soon as auto mode is enabled (in any settings layer, via the CLI, or via managed settings).

Replacing the allow section with narrower custom rules is not flagged — only broad entries are. soft_deny arrays that keep "$defaults" are not flagged.

Trigger example

{
  "permissions": { "defaultMode": "auto" },
  "autoMode": {
    "allow": ["*"],
    "soft_deny": ["Read(./notes)"]
  }
}

Safe alternative

Keep the built-in classifier baseline and add only narrow, specific rules:

{
  "autoMode": {
    "allow": ["$defaults", "Bash(npm test:*)"],
    "soft_deny": ["$defaults", "Read(./secrets/**)"]
  }
}

References

• OWASP LLM03:2026 – Excessive Agency
• Claude Code permissions — auto mode classifier: https://code.claude.com/docs/en/permissions
• CFG004 (defaultMode: bypassPermissions/auto) — the activation half of the same threat.

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation