Claude Code ships with six permission modes. Plan mode looks like a real guardrail, but reading the source shows the entire enforcement is one string in the system prompt. It's trivially bypassable, and it's worth understanding why.
Problem
Claude Code ships with six permission modes. Plan mode is one of them. When active, it injects a system reminder that reads like a real guardrail:
Plan mode is active. The user indicated that they do not want you to execute yet
-- you MUST NOT make any edits, run any non-readonly tools (including changing
configs or making commits), or otherwise make any changes to the system.
The Complete Guide to Claude Code Permissions List The Claude Code permissions list is the...
I Built a Claude Code Hook That Engineers Every Prompt for You — Automatically Most...
An AI coding agent on your laptop runs with your shell. It can rm, it can curl secrets | nc, it can...
Claude Code is the fastest coder I've ever worked with. It can scaffold a feature, write tests, and...
Practical notes on managing Claude Code usage limits on Claude Pro: /clear, prompt caching, /schedule, plans/specs, and model…
Most people meet Claude Code as a coding assistant: open a repo, ask it to fix a bug, review the...
