Claude Code Auto Mode: Does It Cost Extra Tokens?

Auto mode works by putting a second model in front of your agent. Before a shell command or a network call runs, a classifier reads the pending action and decides whether it escalates beyond what you asked for. It's the reason you can leave Claude Code unattended without handing it --dangerously-skip-permissions. It's also a second model call, and somebody has to pay for it.

When a session falls back, Claude Code holds the pending action and prints this at the prompt:

We're changing auto mode to no longer charge for classifier requests in Claude Code. However, this session isn't eligible.

Press Enter and the held action runs, with the rest of the session on billed classifier requests. Press Escand the action is cancelled while the session stays in auto mode. If the notice named a gateway, acknowledging it keeps it quiet on that machine for 24 hours — which is a nice touch and also the reason you can stop seeing a bill you're still paying.

Anthropic names the cause plainly in the docs, and it's worth reading twice if you run any kind of proxy: an LLM gateway between Claude Code and the APIthat strips or rewrites request headers, drops request body fields it doesn't recognize, or edits responses on the way back.

Concretely, the server-side check rides along on your normal model requests. Claude Code adds a safeguards field to the request and reads a safeguard_results field off the response. A gateway that validates request bodies against a schema it wrote last quarter will drop safeguardsbecause it's unfamiliar. A gateway that normalizes streaming events will drop safeguard_results or rewrite tool-use IDs. Either way the server never gets asked, or Claude Code never gets the answer, and you land on the billed path.

This is the irony of the whole change. The people most likely to route Claude Code through LiteLLM, OpenRouter or a homegrown proxy are the people running it hardest: teams doing central key management, spend caps, audit logging. They get the most classifier calls and they're the ones still paying for them.

The durable fix is a pass-through gateway: forward request headers and body fields unchanged, including ones you don't recognize, and return responses and streaming events without dropping keys or rewriting IDs. That's not a one-off workaround for this feature — it's what keeps a gateway working with the next three features too. A gateway that edits the protocol is a gateway that breaks on every release.

v2.1.278 added an Auto mode server row to /status. It reads Enabledwhile the server's checks are deciding your actions, and Disabled once the session has fallen back.

Check it aftera handful of tool calls, not at startup. The fallback can trigger as early as the session's first checked action or much later, and once it holds it holds for the rest of the session. A single action the server couldn't check doesn't flip anything — Claude Code handles that one itself and asks the server again on the next request.

If you run unattended jobs, know where the notice goes. In a headless claude -p run it prints to stderr. With stream-json output it arrives as a system warning message your Agent SDK app can read off the message stream. In the VS Code extension it shows up in the conversation with nothing to acknowledge. Every scheduled job I run is a -pinvocation, and stderr on a cron job is exactly where a cost notice goes to die. If you're not capturing it, grep for it.

Anthropic never published a number. An independent reverse-engineering analysis of the Claude Code bundle did: roughly 2,000 cached tokens for the system prompt and CLAUDE.md, ~4,000 uncached transcript tokens, and about 100 output tokens per check — landing at 15–28% overhead on a 20-turn session with three side-effecting tool uses per turn.

Two caveats before you quote that at anyone. It's third-party, not official. And it was measured during the window when the classifier inherited your main conversation model — so an Opus session paid Opus rates for every check. The classifier now defaults to Claude Sonnet 5 regardless of your /modelpick, which already cut the worst case well before the server-side change landed. Treat 15–28% as a historical ceiling, not today's number.

It only falls back to your session's model in narrow cases: when the session runs Claude Sonnet 4.6, or when availableModelsexcludes Sonnet 5, or — on Fable sessions — an Opus model. The session's first auto-mode request validates the default, and after that it's locked for the session.

The classifier doesn't see every tool call, which is the single most useful thing to understand here. Actions resolve in a fixed order, and only the leftovers reach the classifier:

• Free:reads, searches, code navigation, and file edits inside your working directory — auto-approved, no classifier call. Protected paths are the exception.
• Free: anything matching your allow or denyrules, which resolve before the classifier is consulted. Note that entering auto mode drops broad rules that grant arbitrary code execution — Bash(*), wildcarded interpreters, Agent rules. Narrow ones like Bash(npm test)survive, and they're free.
• Billed:shell commands and network operations. That's where essentially all the overhead lives.
• Free: per-connection network checks inside the sandbox. The classifier judges the hosts a command names together with the command, in one review, then Claude Code checks each connection against the approved list on its own.

Subagents are the multiplier nobody budgets for.The classifier fires at three points per subagent: once on the delegated task description before it spawns, once on every action it takes, and once on its work and final report before the parent reads it. Fan out to six subagents and you haven't tripled the classifier load, you've multiplied it. If you're sizing an agent budget, my post on what a Claude subagent actually costs in tokens covers the base numbers this stacks on top of, and agent teams vs subagents matters here too — every SendMessage between agents goes through the classifier before delivery.

The cheapest real lever isn't a setting. It's writing narrow allow rules for the commands your agent runs fifty times a day, so they resolve before the classifier ever sees them. Pair that with the Bash sandbox and permission rules and you cut the call count and the latency at the same time, since every check is a round trip before execution.

Probably not, and it's worth being clear about what it does. Setting it to 0 before the session starts tells Claude Code to stop asking the server at all:

export CLAUDE_CODE_AUTO_MODE_SERVER=0

Classifier requests are then always Claude Code's own, billed the same way, and the notice never appears. It silences the message, not the charge.The only good reason to reach for it is when you already know your gateway can't pass the checks through and you want a clean terminal in the meantime. It isn't read on a direct connection to the Anthropic API, and Anthropic labels it temporary and removable in a later release — so don't build it into a managed settings file you'll forget about. (Separately: setting CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1while this variable is unset also turns the server checks off. Worth knowing if you set that flag for unrelated reasons and wondered why your bill didn't move.)

One more thing that catches teams on Bedrock, Agent Platform and Foundry: auto mode only works there with Claude Sonnet 5, Opus 4.7 or later, and the Fable models. Pin an older model in that stack and auto mode isn't unavailable-with-a-warning, it just isn't in the Shift+Tab cycle.

Charging people for a safety check they didn't ask for was always going to be an awkward position, and moving it server-side is the right call. What I like less is that the fallback is silent-ish by design: one notice, one Enter, and on a gateway it won't bother you again for 24 hours. If you run a fleet of unattended sessions, the practical advice is boring — check /status on a real session this week, and if the Auto mode server row says Disabled, go fix the proxy rather than the env var.

And while you're in there: auto mode pauses and starts prompting again after 3 consecutive blocks or 20 totalin a session. Those thresholds aren't configurable. An agent that keeps getting told no isn't just burning classifier calls, it's about to stop being autonomous at all — usually a sign the task needs narrower rules, not a bigger budget.