Have you ever wondered: when Claude Code automatically executes operations in Auto mode, who’s judging “can I do this?”

It’s not hardcoded rules - it’s another AI: the YOLO classifier. It’s Claude Code’s “safety gatekeeper,” specifically responsible for把关 when unattended.

What is YOLO? AI Auditing AI

YOLO (You Only Live Once) classifier is an independent AI system. When the main AI (Claude) wants to execute a tool call, YOLO independently judges: “Is this operation safe?”

It’s like a large bank transfer: the teller (main AI) wants to operate, the risk control system (YOLO) reviews. Two AIs are independent, avoiding single points of failure.

Workflow:

Main AI: I want to execute this Bash command
    ↓
YOLO Classifier: Let me check... is this command safe?
    ↓
Safe → Let through, main AI continues executing
Dangerous → Block, escalate to human confirmation

Layered Filtering: Four Safety Gates

Not all operations require AI review. YOLO has four gates, filtering层层:

Gate 1: Safety Whitelist

Read-only operations are inherently safe, pass through directly:

  • Read: Read files
  • Grep: Search
  • Glob: File matching
  • LSP: Code analysis
  • TodoWrite: Task management

These operations can’t corrupt data, no review needed.

Gate 2: Input Filtering

Each tool can define a toAutoClassifierInput method, deciding which fields to expose to YOLO.

If it returns an empty string, this tool call has no sensitive content, pass through directly.

It’s like security check: some things are obviously fine at a glance, no need for X-ray machine.

Gate 3: Stage 1 Fast Determination

Operations passing the first two gates enter YOLO review. But YOLO doesn’t dive straight into deep analysis - it has two stages:

Stage 1: Fast Determination

  • Uses extremely small token budget (64 tokens)
  • Uses concise XML format output
  • Goal: “Quickly pass obviously safe operations”

Output format is simple:

<block>no</block>  ← Pass through

Or:

<block>yes</block>
<reason>Deleting root directory is too risky</reason>

Stage 1 directive is “rather block than miss” - any doubt gets marked as block.

Gate 4: Stage 2 Deep Reasoning

Operations blocked in Stage 1 escalate to Stage 2:

  • Larger token budget (4096 tokens)
  • Requires <thinking> tag for reasoning
  • Re-evaluate, correct possible misjudgments

It’s like:

  • Stage 1: Security guard glances and finds something suspicious, stops first
  • Stage 2: Officer interrogates carefully, determines if truly problematic or a misunderstanding

The Art of Safety Whitelist

YOLO’s whitelist design has several elegant details:

Write Operations Not Whitelisted

File edits (Edit, Write) aren’t whitelisted. But there’s an exception: edits within working directory auto-pass, only outside directory requires review.

It’s like:

  • At home (working directory), do whatever you want
  • Outside (outside directory), be careful

Swarm Coordination Tools Are Whitelisted

SendMessage, TeamCreate and other coordination tools seem to have side effects, but subagents each have independent permission checks, so coordination level is safe.

It’s like: the team leader giving orders isn’t dangerous, execution is dangerous.

Classifier Itself Is Whitelisted

Avoids recursive calls: when YOLO reviews YOLO calls, it can’t trigger YOLO again.

Transcript: What Does YOLO See?

YOLO doesn’t see raw messages - it sees “transcripts” - filtered summaries.

Can see:

  • User instructions
  • Tool calls (tool_use blocks)

Cannot see:

  • Main AI’s free-text output (prevents injection attacks)
  • Images and other non-text content

Transcript supports two formats:

  1. Text format: User: xxx\nBash: ls -la
  2. JSONL format: {"user":"xxx"}\n{"Bash":"ls -la"}

JSONL is more secure because newlines are escaped, can’t forge tool call lines.

Rejection Tracking: Preventing Dead Loops

YOLO could fall into a pathological loop:

Main AI tries operation A → YOLO rejects
Main AI tries operation A differently → YOLO rejects
Main AI tries another way... → YOLO rejects

Rejection tracking solves this with two counters:

  • Consecutive rejection count: After 3, fall back to human mode
  • Total rejection count: After 20, fall back to human mode

Successful operations reset “consecutive count” but not “total count”. So even with interspersed successes, accumulated rejections trigger fallback.

It’s like: if you’re stopped by security three times in a row, or stopped 20 times in a day, the manager steps in.

Template System: Differentiated Security Policies

YOLO’s system prompt isn’t fixed - it’s template combinations:

External user template: For public versions, conservative security policy Anthropic internal template: For internal development, possibly more permissive

Users can also customize rules:

{
  "autoMode": {
    "allow": ["Allow running npm test"],
    "soft_deny": ["Deny modifying files outside project directory"],
    "environment": ["This is a React project"]
  }
}

These rules inject into YOLO’s system prompt, affecting AI decisions.

Error Handling: Fail Means Block

YOLO’s design principle: Any uncertainty equals block.

  • API returns unparseable → Block
  • API timeout → Block
  • API returns 429/500 → Block
  • User cancels → Block

Only exception: unavailable: true flag tells caller “the classifier is down, not truly dangerous.”

It’s like a bank risk control system failure - default to denying all transactions rather than risking funds.

Practical: How to Use Auto Mode Well

1. Add Custom Rules

Add in CLAUDE.md or settings.json:

{
  "autoMode": {
    "allow": [
      "Allow running make clean in build directory",
      "Allow npm install and npm test"
    ]
  }
}

2. What to Do If Blocked Repeatedly?

If blocked 3 times consecutively, system automatically falls back to human confirmation. At this point:

  • Check if CLAUDE.md has relevant rules
  • Manually allow, observe subsequent behavior
  • Adjust autoMode rules if needed

3. Performance Optimization

YOLO classification has costs:

  • Stage 1: ~64 tokens, sub-second latency
  • Stage 2: ~4096 tokens, needs to wait

Can skip classification via toAutoClassifierInput returning empty string, reducing overhead.

Implications for Building AI Agents

YOLO classifier demonstrates several key patterns for AI safety auditing:

Pattern 1: Layered Short-Circuit Filtering

Not all requests need deep review. Set up multi-layer filtering:

  • Whitelist (zero cost)
  • Input filtering (low cost)
  • Fast determination (medium cost)
  • Deep reasoning (high cost)

Pattern 2: Fail Means Block

Safety systems must have conservative defaults. Any failure equals “block operation.”

Pattern 3: Consecutive Anomaly Degradation

Automated systems can fall into loops. Monitor consecutive failures/rejections, degrade to human mode after threshold.

Summary

YOLO classifier is the safety cornerstone of Claude Code Auto mode:

  • AI auditing AI: Independent model makes safety decisions
  • Four gates: Whitelist → Input filtering → Stage 1 → Stage 2
  • Transcript mechanism: Only exposes necessary info, prevents injection
  • Rejection tracking: Prevents dead loops
  • Fail means block: Conservative safety philosophy

It’s like:

  • Main AI is the driver
  • YOLO is the co-pilot’s safety officer
  • Whitelist is the “obviously safe” fast lane
  • Stage 1 is the “quick glance” preliminary judgment
  • Stage 2 is the “think carefully” deep analysis
  • Rejection tracking is the “don’t let driver get stuck” protection mechanism

Understanding YOLO lets you:

  • Use Auto mode more effectively
  • Optimize experience through custom rules
  • Implement similar safety mechanisms in your own AI agents

Next up: Hooks - Jumping In at Key Points.