Put the agent in a sandbox.
The docs all say there is a time and billing cost:
> Auto mode may have a small impact on token consumption, cost, and latency for tool calls. https://claude.com/resources/articles/auto-mode#what-to-expe...
https://code.claude.com/docs/en/permission-modes#cost-and-la... doesn't say anything specific. It mentions that server-side classification can be used but doesn't talk about the billing for it.
But at the end of the day it is a leaky system. It may reduce the frequency of bad actions but doesn't prevent it. So you need the sandbox either way.
This post is dated August 7, 2026: "In the coming month, working with our cloud partners, we plan to make it the default across all of these and no longer charge for classifier overhead." https://claude.com/resources/articles/auto-mode-default-in-c...
> but doesn't prevent it. So you need the sandbox either way.
Yep. Single points of failure are bad.
I'm actually working on multi harness auto mode. It's already done for Pi and I'm currently working on copilot cli port (where it is needed the most by the fa r of autopilot in copilot being so atrocious).
The correct way for auto approve to work is similar to what claude code does (a deterministic algorithm where a separate model reads what the user says and adds rules based on what the user enables).
I couldn't believe such a thing that works well doesn't exist, but it doesn't. You either have to do borderline yolo or you cannot leave a model working overnight and not find it got stuck on some silyness after an hour.
It's an NVidia product, and so far I quite like their sandboxing and policy system. I'm still getting used to the download and upload flow though, it makes it a bit more annoying to read diffs and commit (unless you let it git as a part of the policy)
Basically Podman is a more secure version of Docker.
I would keep stuff like secret keys outside the container and sign/push commits manually.