Tech • AI • Robotics
Claude Code can run code on your PC: secure it!
8/10TL;DR
Anthropic has made Claude’s auto mode the default for many users, but safe use of Claude Code now depends on strict permissions, package-install controls, hooks and system isolation rather than trust in prompts alone.
KEY POINTS
Why auto mode became default
Since 14 August 2026, Claude has started in auto mode by default for many users because people were already approving about 93% of permission requests. The shift reduces repeated confirmation prompts, but it does not mean unrestricted operation. Claude Code can read files, edit code, run commands, install dependencies, use Git and connect to outside tools, making local safeguards essential.
Manual mode for untrusted repositories
A cautious workflow is to switch to manual mode when opening a repository from someone unknown or only partially trusted. Auto mode is more appropriate in environments that are already well understood. The recommended approach is not simply auto versus manual, but auto mode with explicit barriers that limit what the agent may do.
Permissions should protect secrets
In project settings, rules can be defined to block access to sensitive files such as .env. Permission evaluation follows the order deny, then ask, then allow, so hard denials take priority. That makes deny rules a stronger defense than natural-language instructions asking the model not to open certain files.
Prompt instructions are not a security boundary
A guidance file such as CLAUDE.md may influence behavior, but it is not deterministic and should not be treated as a control layer. It may be followed much of the time, but not reliably enough to stop dangerous actions. Blocking actions must happen through permissions or code-based enforcement, not advisory text.
Supply-chain risk is a major threat
Dependency installation is one of the most exposed paths. Malicious npm packages can steal cryptocurrency wallets, SSH keys and GitHub credentials, and some malware now targets configuration files and hooks to remain persistent. Because modern software relies heavily on third-party packages, the risk is not theoretical but ongoing.
Restrict package managers and harden installs
One defensive setup is to ban npm, npx, Yarn and Bun outright and allow only pnpm. Additional hardening can include rejecting packages released less than seven days earlier, on the premise that obviously malicious packages are often detected within hours or days. Installation scripts such as preinstall, install and postinstall deserve special scrutiny because they are a common malware vector.
Using Socket Firewall in front of pnpm
An added layer is Socket Firewall, used as sfw pnpm rather than raw pnpm. It sits in front of the package manager, filters network traffic tied to package downloads and can flag or block known malicious packages. The free version is described as mainly warning-based, while stronger blocking is associated with paid tiers, but it still adds friction against unsafe installs.
Hooks can enforce command policy
Permissions work best for absolute bans, but hooks are better when extra logic is needed. A pre-tool-use hook can inspect shell commands and block direct pnpm add, install or dlx if they do not go through sfw pnpm first. That approach is deterministic, but hooks are executable code running with the user’s privileges, so unreviewed hooks downloaded from the internet create their own risk.
Prompt injection remains a live concern
Attackers can hide malicious instructions in README files, issues, web pages, copied text, terminal output or external tool responses. A prompt injection might try to override prior instructions, force npm installs or exfiltrate .env contents. Built-in protections help, but a layered model is safer: if the model is tricked, denied permissions and command hooks should still prevent damage.
Isolation reduces the blast radius
The final layer is system isolation. Claude Code includes a sandbox for some shell commands that can limit file-system and network access, though it applies to shell processes rather than acting as a full virtual machine around the desktop app. As of 30 August 2026, this is described as supported on macOS, Linux and WSL2, but not on Windows, making containers, VMs or remote machines useful for stronger separation.
Every extra tool expands the attack surface
External connectors such as MCP servers, plugins and computer-use features can expose GitHub, databases, APIs, SaaS services or desktop applications. The recommended rule is strict minimization: if Claude Code does not need a capability, it should not receive it. Reducing tools and permissions narrows the number of ways a compromised workflow can cause harm.
CONCLUSION
The move to default auto mode reflects how people were already using Claude, but it also raises the stakes for local security design. In practice, safe use of Claude Code now depends on layered controls that restrict secrets, package installs, command execution and system reach before anything goes wrong.
Explain this