Claude Code Just Auto-Approved Actions While You Were AFK — The Agent Trust Crisis Has a New Front

<p><strong>TL;DR:</strong> On 1 July 2026, Anthropic shipped Claude Code 2.1.198 with a feature nobody asked for and nobody was told about: a 60-second AFK timer that let the agent auto-answer its own questions and keep going without you. The escape hatch was an undocumented environment variable traded peer-to-peer in a GitHub thread that racked up 384 thumbs-ups and 143 comments. Anthropic reversed it in 2.1.200, but the auto-continue code still ships in the current binary, gated behind a config flag that defaults to 'never' now. It defaulted to '60s' on Canada Day. This is not about Anthropic. It is about an industry pattern where agent governance mechanisms are an afterthought, and what that means for anyone building software with these tools.</p>

<h2>What actually shipped</h2>

<p>On 17 July, developer Olaf Alders published a forensic teardown of the whole affair on his blog. It hit 100 points and 62 comments on Hacker News. The post is meticulous: 6,000 words, diffing the minified bundle, tracing every code path. I'd recommend reading it, but here is the short version.</p>

<p>Claude Code has a tool called <code>AskUserQuestion</code>. It is exactly what it sounds like: mid-task, the agent stops and says "should I do A or B?" It has appeared in changelogs 15 times across 13 versions. Anthropic documents changes to it routinely.</p>

<p>In 2.1.198, <code>AskUserQuestion</code> gained new behaviour. After 60 seconds without a response, the tool returned a "proceed anyway" result to the model with the message: "No response after ${Math.round(e/1000)}s, the user may be away from keyboard. Proceed using your best judgment based on the context so far."</p>

<p>The countdown only became visible in the final 20 seconds. For the first 40, the dialog looked exactly like an ordinary blocking question. Nothing on screen told you a timer was running. If you were running multiple agents (as Anthropic's own Boris Cherny has advocated) you were not going to catch all of them. And the partial-answer path was worse: start answering a multi-part question, step away, and the timeout submitted your incomplete answer plus whatever the model guessed for the rest.</p>

<p>Permission prompts were exempt. The timer only applied to <code>AskUserQuestion</code>, not to plan approval or tool permission dialogs. But here is the thing. Plenty of teams run Claude Code with <code>--dangerously-skip-permissions</code> or allowlisted deploy commands. That is what automating a coding agent means. For those users, the permission layer was never going to fire, so its immunity to the timer bought precisely nothing. The question was the only gate left, and the timer opened it silently.</p>

<p>None of this appeared in the 2.1.198 changelog. Thirty entries. Not one about auto-continue. Nor in 2.1.199, which shipped 24 entries while the GitHub issue was already open.</p>

<h2>384 thumbs-ups and an undocumented escape hatch</h2>

<p>On 2 July, Aleksey Nogin filed GitHub issue #73125. Within an hour, a commenter surfaced the escape hatch: an environment variable called <code>CLAUDE_AFK_TIMEOUT_MS</code>. It was not documented anywhere. No release note pointed to it. No <code>/config</code> option existed. Grepping 2.1.198 for <code>askUserQuestionTimeout</code> returns zero hits. The only way out was a secret env var you learned about from strangers in a bug thread.</p>

<p>The thread got 384 👍 reactions and 143 comments. That is not a niche complaint. That is a collective "what the hell."</p>

<p>Anthropic reversed the behaviour in 2.1.200, about two days after the report. Fair play on the turnaround speed. But the changelog's verb is precise: "no longer auto-continue <em>by default</em>." Nothing was removed. The machinery is fully intact in the current binary (2.1.211, eleven releases later). The setting is <code>askUserQuestionTimeout</code>, surfaced in <code>/config</code> as "Question auto-continue timeout," with options 60s, 5m, 10m, never. Unset now resolves to never. On 1 July, it resolved to 60s.</p>

<p>Alders' post makes the point better than I can: "The same code that auto-answered for you is still shipping, one config value away, governed by the same process that turned it on silently the first time."</p>

<h2>This is not a one-off</h2>

<p>I am not singling out Anthropic here. The pattern is industry-wide, and it is accelerating.</p>

<p>Two weeks ago, a security researcher discovered that Grok Build CLI had been silently uploading entire Git repositories to xAI's servers. Not just the files you asked it to work on. The whole repo. The exfiltration code is still in the open-sourced binary. Sam Altman called it "concerning." That is one word for it.</p>

<p>Before that, GPT-5.6 Sol shipped a bug that expanded the <code>$HOME</code> environment variable and deleted files across users' machines. Production databases got truncated. The documentation technically mentioned the behaviour, if you squinted at the right paragraph of a manual nobody reads before running an agent in their terminal.</p>

<p>And underneath all of this, Georgia Tech's Vibe Security Radar tracked 35 CVEs in March 2026 directly attributable to AI-generated code, up from six in the same period a year prior. A Q1 2026 assessment of over 200 vibe-coded applications found 91.5% contained at least one vulnerability traceable to AI tooling. Sixfold. That is the number.</p>

<p>The common thread is not "AI is dangerous." It is: the governance mechanisms are missing. These tools ship features without documentation, without opt-in defaults, without audit trails, and sometimes without any evidence a human reviewed the diff before it hit the release channel. Alders asks the question directly: did a human sign off on this? Did a human release manager diff the release and ask "is this a good idea"? I find it hard to believe the answer to all of those is yes.</p>

<h2>Where does the fix actually live?</h2>

<p>You could pin your Claude Code version. You could disable auto-update. You could audit every team member's <code>settings.json</code> for <code>askUserQuestionTimeout</code> values that are not "never." You should do all of those things, and I will tell you how in a moment.</p>

<p>But the architectural fix sits one level up. It is the difference between a platform that gives an agent an unbounded terminal and a prayer, and a platform where every action the agent takes is mediated through structured permissions, an audit log, and a human-in-the-loop by design.</p>

<p>Governed no-code platforms (Stacker, Bubble, Webflow) do not expose you to this class of failure. Not because they are "safer AI" but because their architecture does not depend on whether a model provider remembered to tell you about a feature. When your build surface is structured, when the agent touches specific data sources, specific UI components, specific logic blocks, all within a permission model you configured, there is no vector for "model auto-answered 'staging or production?' while I was making a sandwich."</p>

<p>This is not a pitch about no-code being better than code. It is a pitch about governed platforms being better than ungoverned terminals. If you are building software that matters, software that touches customer data, production infrastructure, or revenue, the question is not which AI model to use. The question is whether your platform puts you or the model in the driver's seat when it matters.</p>

<h2>What ops directors should do this week</h2>

<p>If your team uses AI coding tools in production workflows, here is what I would do before August:</p>

<p><strong>1. Audit every AI tool's auto-update setting.</strong> Claude Code, Codex CLI, Grok Build, Cursor, Windsurf. They all auto-update. Auto-update means silent feature changes. Silent feature changes mean you are discovering new behaviour in production. Disable auto-update on anything that touches build pipelines or deploys. Pin your versions. Read the changelog before upgrading. Yes, this is tedious. It is also table stakes.</p>

<p><strong>2. Check your Claude Code config.</strong> Run <code>/config</code> and look for "Question auto-continue timeout." If it is anything other than "never," change it. Also check <code>settings.json</code> for <code>CLAUDE_AFK_TIMEOUT_MS</code> and <code>CLAUDE_AFK_COUNTDOWN_MS</code>. These env vars still override the config setting. Remove them unless you have a specific, documented reason for keeping them.</p>

<p><strong>3. Map your permission surface.</strong> Which tools has your team allowlisted? Which commands have <code>--dangerously-skip-permissions</code>? If the answer is "deploy" and "yes," you need a different architecture. The permission layer is your last line of defence. Do not disable it on the tools that matter most.</p>

<p><strong>4. Evaluate the platform, not just the model.</strong> If your current stack gives an AI agent a shell and trusts it to behave, ask yourself whether that is still acceptable. Governed platforms cost more in setup time and less in incident response. That trade is increasingly worth making.</p>

<h2>The takeaway</h2>

<p>The Claude Code misfeature is not a story about a bad default. It is a story about velocity without governance, and it is the third major incident of its kind in a single month. Anthropic shipped a feature that auto-approved agent decisions, documented none of it, left the escape hatch to word of mouth, and (after reversing) kept the code in the binary. If that sequence does not make you reconsider what you let an agent touch, I am not sure what will.</p>

<p>AI coding tools are moving faster than their governance. That is not going to change. What can change is whether your platform assumes good behaviour from the model, or whether it enforces good behaviour through architecture. One of those ages well. The other ships 60-second timebombs on a Tuesday and hopes you notice.</p>