https://hackerpaper.kaipfister.de/p/2604.04978/Collected HN comments and submissions linking this paper.enSun, 08 Nov 2026 05:37:00 GMThttps://news.ycombinator.com/item?id=50410647urn:hackerpapers:mention:2604.04978:50410647Sun, 08 Nov 2026 05:25:54 GMT<p>Yes, furthermore in practice auto mode does not appear to provide anything approaching deterministic gating: &quot;Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code&#x27;s Auto Mode&quot; https://arxiv.org/abs/2604.04978 (Shared by hkalbert71 the other day in: https://news.ycombinator.com/item?id=50387838)</p><p><a href="https://hackerpaper.kaipfister.de/p/2604.04978/">Paper and discussion history</a>. A mention is not an endorsement.</p>cs.SEhttps://news.ycombinator.com/item?id=50388675urn:hackerpapers:mention:2604.04978:50388675Fri, 06 Nov 2026 05:50:18 GMT<p>I haven&#x27;t found a comprehensive independent code audit of Claude Code&#x27;s full permission implementation. Anthropic&#x27;s documentation does distinguish permission rules and pre-tool hooks from model instructions. It also documents OS-enforced sandboxing for shell commands, which has a narrower scope than all agent actions. An independent stress-test of Auto mode is available here: https://arxiv.org/abs/2604.04978. It&#x27;s a behavioral evaluation, not a source-code audit. The important question is whether every state-changing action passes through an enforceable boundary before execution, including…</p><p><a href="https://hackerpaper.kaipfister.de/p/2604.04978/">Paper and discussion history</a>. A mention is not an endorsement.</p>cs.SE