Claude Code stopped asking permission for everything, and that is not as risky as it sounds.

A separate classifier model checks every action Claude takes. It only sees your messages and Claude's tool calls, not its reasoning. Read-only stuff skips the check entirely. Everything else gets reviewed in real time. There is even a probe scanning web content for prompt injection before Claude touches it.

This is the actual system letting Claude run long tasks unattended.

If you want the full masterclass on what Claude Code can do with setups like this, following article covers it end to end.