Ant Group Engineer Reverses Claude Code Source Code: Auto Mode's Four-Layer Decision Pipeline and Security Classifier Details Exposed

Ant Group engineer Chen Cheng, author of front-end framework Umi.js, reversed the source code of Claude Code 2.1.81, fully revealing the inner mechanism of auto mode, including a four-layer decision pipeline and an independent AI security classifier.

The four layers are: permission rule check (pass if hit), acceptEdits mode simulation (low risk skips classifier), read-only tool whitelist (e.g., Read/Grep, unconditional pass). If the first three layers fail, Claude Sonnet is called for security classification. The classifier uses Sonnet (cost-delay tradeoff), temp=0 (deterministic output), monitors three risks like prompt injection, and uses user's CLAUDE.md config to judge intent.

Interception rules cover over 22 categories (e.g., force push, data leakage). Exceptions include 7 types (e.g., test keys, local file operations). Circuit breaker: 3 consecutive or 20 total rejections → manual mode; headless mode aborts. Auto mode prompt injection occurs every 5 rounds: 1 full version and 4 concise versions, balancing context and stability.