Anthropic's advice for Claude Code has changed. In a talk for the AI Engineer Code Summit on November 11, Lydia Hallie, a member of technical staff on the Claude Code team, said much of what developers added to their setups over the past year now holds the newer models back. Her short version: stop approving every command, cut down your CLAUDE.md file, and put your safety rules where software enforces them.
Hallie had technical problems during the live session, so she recorded the talk again at home. The 17 minute video is on the AI Engineer YouTube channel.
From operator to manager
Hallie compared two kinds of sessions. Earlier this year, she said, developers used models like Opus 4.5, which "would just stop a lot earlier," and they kept correcting it. People added words like "important" and exclamation marks to CLAUDE.md, and they either approved each command by hand or used the riskier skip-permissions flag.
Now, she said, teams at Anthropic run "dozens of sessions at the same time, running for hours," and some sessions start and check other sessions. She pointed to an Anthropic blog post from October that said the company went from about 2,500 code changes a day in May to more than 30,000 a day in September.
Her main point: each time a person steps out of the loop, something else must take that job. That is the model, the harness (Claude Code itself), or the environment the session runs in.
Shorter CLAUDE.md files
Hallie said Opus 5.5 understands intent and code much better, so heavy instructions can now hurt. Emphatic rules "can actually make the model go off track," she said, with more tool calls and worse results.
Her rule is that CLAUDE.md should only hold what Claude cannot see in the code. Her example is a service that still uses a legacy source that the code does not reference directly. Notes about your stack or where to look are no longer needed. She named a command, /doctor prompt-audit, that checks your CLAUDE.md and skills against a model such as Opus 5.5 and flags what that model no longer needs.
Auto mode, and its limits
Auto mode runs a separate classifier on most actions other than reading or editing files in the project. Hallie said Anthropic made it the default permission mode in August. It allows commands it knows are safe, like running tests, and blocks ones it is unsure about. By default it trusts only the current folder and repo, so a push to a separate deploy repo gets blocked. You can fix that by describing trusted repos, buckets and domains in plain English in your settings.
She repeated the numbers from Anthropic's August 7 auto mode article. In that study, 1,053 paid testers worked in a test environment, and one permission prompt per session was swapped for a clearly dangerous command. Testers caught it 13.6% of the time (143 of 1,053). Auto mode blocked 89% (937 of 1,053). The same article says users approve 97% of permission prompts in Claude Code.
Hallie did not call that a guarantee. "About one in 10 of those commands still went through," she said. If you need a hard stop, use a deny rule. Claude Code checks deny rules before the classifier, and "if a tool call matches a deny rule, the classifier never even sees it."
To decide what needs a rule, she asks one question: "can I take it back?" Wrong code can be reverted, so leave it to the model. Throwing away uncommitted changes, or reading a key into the transcript, cannot be undone, so those get a rule. A deny rule on your .env file also stops commands like cat from opening it.
What permissions cannot see
The weak spot Hallie described is side effects. A command like npm test looks normal, so auto mode runs it. But the test can run code you did not write, such as a dependency. If that code is compromised, it could read your .env file or SSH keys and send them to an unknown server. A person would also have clicked allow. "Permissions only decide if a tool call runs, but they cannot limit what it can reach once it's running," she said.
Her answer is to limit the environment. On your own machine, the Claude Code sandbox lets the operating system control which files a command can read, where it can write and which hosts it can reach, including child processes. But it only covers shell commands. Claude's own file tools, MCP servers and hooks still run on your machine.
So Hallie prefers cloud sessions: a separate machine with a fresh copy of the repo that keeps running when your laptop is closed. Your .env file, SSH keys and GitHub token are not there. API keys can be added as network secrets that Claude can use without the value going to the model, and network access is limited by default to package registries and GitHub. She still runs cloud sessions in auto mode with deny rules committed to the repo, because "this machine is disposable, but the things that leave it aren't," such as a pushed commit.
Checks instead of reading every diff
Since nobody reads every change after a long session, Hallie wants checkpoints that return pass or fail: tests, a build, a screenshot. For checks that must run, she uses hooks, scripts that Claude Code runs at set points, such as the linter after each edit or the full test suite before a session ends.
She flagged one detail. Most test tools exit with code 1 on failure, and with code 1 Claude Code marks the task complete anyway. Scripts must exit with code 2 to send Claude back to fix it. The hooks docs describe exit code 2 as "the way a hook signals 'stop, don't do this.'"
Past that, CI is the backstop. On Hallie's team, every pull request is reviewed first by a separate Claude with fresh context, plus a group of agents that double-check each bug it finds. Human review then depends on risk: docs and copy changes need no person once checks pass, normal product changes get one reviewer, and risky ones might need two.
Why it matters
The talk shows Anthropic wants developers to stop acting as the approval step in Claude Code. It also shows the limits. Auto mode still misses about one in ten planted dangerous commands in Anthropic's own study, and no permission rule can see what a script does after it starts. Hallie's fix is deny rules, a sandbox or a cloud machine, and automated checks, not more trust in the model.
She ended with the same direction we covered in Claude Code Projects: one orchestrator session, run by a judging model like Fable 5.2, that starts worker sessions on Opus 5.5 and sends back work that is not done. For background on approval prompts, see our explainer on AI agent permissions and our report on how Claude Code's "Don't ask again" exposed secrets.
Sources
- Rethinking Claude Code Best Practices, Lydia Hallie, AI Engineer (YouTube)
- AI Engineer Code Summit 2026 session page
- Auto mode is now the default in Claude Code, Anthropic (August 7, 2026)
- Claude Code hooks documentation
- Claude Code sandboxing documentation
- Claude Code skills documentation (/doctor prompt-audit)
