# Tool approval prompts and autonomy modes (`work.permission_prompts`)

Feedback Bench, coding agents, built 2026-10-19, window 2026-08-31 to 2026-10-18. Web page: https://feedbackbench.com/coding-agents/#/criterion/work.permission_prompts

Area: [Doing the work](https://feedbackbench.com/coding-agents/criteria/work.md)

**Definition.** How often and when the agent asks permission to run tools or commands, and whether auto or bypass modes behave as configured.

**Boundary.** Not this: see [Risky or irreversible actions without confirmation](https://feedbackbench.com/coding-agents/criteria/work.destructive_actions.md) for acting without permission. Not this: see [Safety filters block legitimate coding tasks](https://feedbackbench.com/coding-agents/criteria/work.safety_refusals.md) for content blocks.

Rated user-weeks, all agents: 1216. Complaint share: 77%.

## The brief

Written by large language models from this page's numbers and the posts it quotes, then checked: every number in the text is in the build. Interpretation, not measurement.

Claude Code handles permission prompts best, and OpenCode comes next. Users of both say the agent asks before destructive actions, and that they can tune permissions so routine prompts stop. This criterion sits in the middle for how often users rate it: it is the 29th most rated of 63 criteria. When users do rate it, they mostly complain, in 77.5% of rated user-weeks. Google Antigravity ranks low. Its users say it asks for approval on nearly every command, even in its auto modes. They rate permission prompts 4.45 times as often as other users and write 25% of the category's complaints here.

### What separates the best from the rest

Users of the leaders describe controls that work. Claude Code users say auto mode and sandboxes do their job and that risky actions can be blocked outright. OpenCode users point out that permission is denied by default. Google Antigravity users describe babysitting: approving basic git commands one by one, turbo and allow-all modes that keep prompting, and always-allow choices that do not stick. It draws 19 praise to 234 complaints. Claude Code still draws many complaints. Its users rate this 2.01 times as often as other users and write 36% of the category's complaints.

- **Ranks high**: [Claude Code](https://feedbackbench.com/coding-agents/agents/claude-code.md), [OpenCode](https://feedbackbench.com/coding-agents/agents/opencode.md)
  - Claude Code, 2026-10-18, r/ClaudeCode (Reddit): “you can tune permissions in claude so all the constant annoyances never pop up but you can also block certain actions from ever being allowed...like deleting database tables or entire directories.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x9d1yf/it_finally_happened_to_me/phkixd7/)
  - OpenCode, 2026-09-17, @opencode (X): “@opencode the default permission is denied, which is worth more than adding another tool.” [source](https://twitter.com/1628996445654188033/status/2100472901535179238)
- **Ranks low**: [Google Antigravity](https://feedbackbench.com/coding-agents/agents/antigravity.md)
  - Google Antigravity, 2026-10-18, @antigravity (X): “@antigravity , i use antigravity cli sometimes. i wont say i am a power user of agy. but i am really frustrated by the approval system. literally i had to babysit for tow hours and accepts nearly hundred commands. most of them are basic git and playwrite commands. [link]” [source](https://twitter.com/2039376148438622208/status/2111827089389396199)
  - Google Antigravity, 2026-10-18, r/google_antigravity (Reddit): “sometimes i have to wait a min or two after switching to turbo before it stops asking for permission.” [source](https://www.reddit.com/r/google_antigravity/comments/1x9asl0/antigravity_turbo_mode_asking_for_permission/phjy79h/)

## How it breaks

Rule: A separate pass sorts complaints into failure modes. For each criterion with at least 30 complaining user-weeks, a large language model reads 150 complaint posts drawn at random and names 4 to 8 failure modes; a second large language model then puts every complaint post on that criterion in one mode, or in Other when it fits none. Modes are fixed once named, and new posts are sorted into them each week. A mode counts distinct user-weeks with a complaint in it, per agent; across agents, one user-week per agent. Modes do not change the labels or the Feedback Score. Examples: up to 3 posts per mode from different users, chosen and checked as receipts are.

The largest mode is constant prompts for routine, low-risk actions, at 24% of complaining user-weeks. Google Antigravity and Claude Code users write about equal shares of it. Next come auto or bypass modes that still prompt, and 40% of those complaints are from Claude Code users. Two smaller modes come mostly from Claude Code: sessions that stall unnoticed on a pending approval, and approval hooks that do not take effect. Each is 63% Claude Code.

955 complaining user-weeks.

| Failure mode | User-weeks | Posts | Agents (user-weeks) | Definition |
|---|---|---|---|---|
| Constant prompts for routine low-risk actions | 228 | 237 | Google Antigravity 78, Claude Code 75, OpenAI Codex 52, Cursor 8, Kiro 6, GitHub Copilot 3, Factory 2, Pi 2, Devin 1, OpenCode 1 | The agent asks for approval so often, including for harmless reads, greps, ls or repeated commands, that the user ends up clicking all the time or has no way to delegate; this includes products that offer no usable auto or smart-review mode, but not cases where a mode was set and ignored. |
| Auto or bypass mode still prompts | 203 | 218 | Claude Code 81, Google Antigravity 54, OpenAI Codex 53, Devin 6, Cursor 4, GitHub Copilot 2, Amp 1, Cline 1, OpenCode 1 | The user has turned on an auto-approve, full-access, bypass or turbo mode, but the agent still asks for approval, drops back to manual approval, or refuses actions that mode should allow; this includes the setting silently resetting in new chats, remote sessions or subagents, but not cases where no such mode exists. |
| Consequential actions taken without asking | 150 | 160 | Claude Code 49, OpenAI Codex 47, Google Antigravity 18, Cursor 15, OpenCode 13, Pi 3, Cline 2, Devin 1, Kiro 1, Zed 1 | The agent, or an auto-approval classifier, does something irreversible or outward-facing without asking for confirmation, such as posting issues, sending messages, deleting data, granting broad access or leaving a sandbox; over-prompting is out. |
| Permission settings confusing or not adjustable | 134 | 141 | Google Antigravity 43, Claude Code 38, OpenAI Codex 29, GitHub Copilot 8, OpenCode 6, Cursor 4, Kiro 3, Pi 2, Factory 1 | Users can't find, understand or change the permission controls they need, for example there is no per-session or per-project setting, project features are locked to one mode, approval prompts are hard to read, or admin-managed settings override user choices without warning; cases where clear settings exist but are ignored are out. |
| Always-allow choices and allowlist rules not honoured | 104 | 108 | Google Antigravity 40, Claude Code 30, OpenAI Codex 15, OpenCode 10, Cursor 5, Pi 2, Kiro 1, Zed 1 | Per-command approvals, "always allow" clicks, wildcard or pattern allowlists, and settings-file rules are not saved or do not match the commands the agent actually runs, so the same prompts keep coming back; failures of the global mode switch itself are out. |
| Sessions silently stalled on pending approval | 60 | 64 | Claude Code 38, OpenAI Codex 18, Google Antigravity 3, OpenCode 1 | An unattended or background task stops on an approval prompt the user doesn't notice, or one that never shows up on that device or UI (mobile, projects, remote), and time is lost until the user checks back; the overall number of prompts is out. |
| Approval hooks and command gating ineffective | 49 | 56 | Claude Code 31, OpenAI Codex 7, OpenCode 4, Cursor 3, Google Antigravity 2, Amp 1, Cline 1 | Custom pre-tool-use hooks or command-matching guards, whether written to auto-allow or to block and ask, are ignored, overridden by built-in review steps, or bypassed when the agent phrases a command differently or reaches the same effect another way; built-in allowlist persistence is out. |
| Other | 77 | 79 | OpenAI Codex 27, Claude Code 26, Google Antigravity 11, OpenCode 5, Cursor 3, GitHub Copilot 1, Devin 1, Kiro 1, Pi 1, Zed 1 | Complaints that fit none of the modes above. |

#### Constant prompts for routine low-risk actions

- Google Antigravity, 2026-10-18, @antigravity (X): “@antigravity what fuckass harness is this. according to antigravity cli logic i have to sit in front of computer all the time and press "always allow" permission to each and every commands in the universe” [source](https://twitter.com/1135175156576313344/status/2111833595690279155)
- Google Antigravity, 2026-10-18, @antigravity (X): “@antigravity , i use antigravity cli sometimes. i wont say i am a power user of agy. but i am really frustrated by the approval system. literally i had to babysit for tow hours and accepts nearly hundred commands. most of them are basic git and playwrite commands. [link]” [source](https://twitter.com/2039376148438622208/status/2111827089389396199)
- Google Antigravity, 2026-10-17, r/google_antigravity (Reddit): “yeah, making it worse is the way to go. tool calls which are subject to access control vs shell commands every single one of which i need to approve. what kind of tone deafness is this?..” [source](https://www.reddit.com/r/google_antigravity/comments/1x7pmma/gemini_can_no_longer_scan_directory_contents/ph9huvp/)

#### Auto or bypass mode still prompts

- Google Antigravity, 2026-10-18, r/google_antigravity (Reddit): “sometimes i have to wait a min or two after switching to turbo before it stops asking for permission.” [source](https://www.reddit.com/r/google_antigravity/comments/1x9asl0/antigravity_turbo_mode_asking_for_permission/phjy79h/)
- OpenAI Codex, 2026-10-18, X search: OpenAI Codex, Codex CLI, Codex app (X): “also, when using codex cli, i am concerned that even if it is automatically approved when "approve for me" is enabled, i still receive a notification waiting for approval.” [source](https://twitter.com/1188829372918026241/status/2111922910193656089)
- Claude Code, 2026-10-18, @ClaudeDevs (X): “auto-mode is broken in cc for a while... sounds like nobody is listening although /feedback has been sent @bcherny @claudedevs” [source](https://twitter.com/87314420/status/2111919031678632120)

#### Consequential actions taken without asking

- OpenCode, 2026-10-12, r/opencodeCLI (Reddit): “honestly its pretty wierd that i never gave it full access to my pc but never asked for any permission either” [source](https://www.reddit.com/r/opencodeCLI/comments/1vbdp1g/anyone_using_freebuff/pfegcrb/)
- OpenAI Codex, 2026-10-11, r/codex (Reddit): “yeah and literally everything is blocked on its fucking sandbox. literally a useless vm.” [source](https://www.reddit.com/r/codex/comments/1x2w0az/undelivered_dots/pf7zjya/)

#### Permission settings confusing or not adjustable

- Claude Code, 2026-10-16, r/ClaudeCode (Reddit): “yes i can't stand how many permission issues i run into. so many things i can't override either that hold it back from being a true assistant.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x7ix85/the_permission_system_is_exhausting/ph4sfeg/)
- Google Antigravity, 2026-10-16, @antigravity (X): “@antigravity also, none of the available commandexecutionpolicy options allow automatic approval of shell commands — you still have to confirm every time 😢 [link]” [source](https://twitter.com/2063470808371179520/status/2110963753063981464)
- Claude Code, 2026-10-12, @ClaudeDevs (X): “@claudedevs @bcherny i find this permission tool to be confusing (or i misunderstand), specifically the "esc to cancel". cancel makes me think i'm not doing anything, but i've found that is the only way to trigger the retry. [link]” [source](https://twitter.com/1946941719263801344/status/2109697947667694065)

#### Always-allow choices and allowlist rules not honoured

- Google Antigravity, 2026-10-17, r/google_antigravity (Reddit): “[link] i don't think that the permission engine works well. i am trying to do something to always allow agent reaonly access witouth edit permission and still it doesn't work. sandbox isn't even more clear in those permission :/” [source](https://www.reddit.com/r/google_antigravity/comments/1x8gpys/how_we_can_enforce_antigravity_cant_even_execute/phcqvh2/)
- Claude Code, 2026-10-10, r/ClaudeCode (Reddit): “i noticed this week that the auto-classifier send to have been changed and ignores some permissions being granted” [source](https://www.reddit.com/r/ClaudeCode/comments/1x2effg/how_to_fix_cc_still_asking_for_permissions_with/pf1gsqe/)
- OpenAI Codex, 2026-10-10, r/codex (Reddit): “it seems that every time a new version of the same app under development is launched, the permissions need to be granted again. beyond this, the agent may want to write scripts so it can observe the app's ui, and each script needs to be granted permission each time it is changed.” [source](https://www.reddit.com/r/codex/comments/1x242zs/grant_macos_permissions_automatically/pez5kz2/)

#### Sessions silently stalled on pending approval

- OpenAI Codex, 2026-10-14, r/codex (Reddit): “fantastic. but codex is now unusable because every step is asking for user approval. edit: what i had hoped would have been a task it could complete while i was asleep failed after five minutes pending approval for its "guarded preflight check that sends no input".” [source](https://www.reddit.com/r/codex/comments/1x5c5wm/tibo_day_8/pgp5voa/)
- Claude Code, 2026-10-08, @ClaudeDevs (X): “@mehulmpt @claudedevs so true. all night it didn't do anything just waited for permission.” [source](https://twitter.com/1740360935892783104/status/2108089102507954387)
- OpenAI Codex, 2026-10-07, r/codex (Reddit): “look cool. i’ve lost count of how many times i’ve left a session, came back later, and found it stuck on “do you want to…” for an hour. 😂” [source](https://www.reddit.com/r/codex/comments/1wz0173/what_are_you_using_to_keep_multiple_agent/ped9lu7/)

#### Approval hooks and command gating ineffective

- Google Antigravity, 2026-10-11, @antigravity (X): “@antigravity i wrote a hook to run tests in my local and expected not to have any confirmation using `decision: "allow"` and never worked 🥲. my agy cli told me the `request-review` might be prior than my pretooluse. is this the problem you are working on?” [source](https://twitter.com/1810320486104272897/status/2109160621665296734)
- Claude Code, 2026-10-05, r/ClaudeCode (Reddit): “the "go find another way" part is my biggest one too. i had guards on file reads and it just started reading files with cat and sed through bash instead. ended up adding a second hook that blocks that in bash too, last week it fired about 160 times.” [source](https://www.reddit.com/r/ClaudeCode/comments/1wwvw6y/whats_the_one_thing_claude_did_that_made_you_add/pdzxlk0/)
- OpenAI Codex, 2026-10-05, X search: OpenAI Codex, Codex CLI, Codex app (X): “claude code 2.1.289 fixed deny rules skipping env-prefixed commands. same test on codex cli 0.160.0's execpolicy checker (no login), rule ["rm","-rf"]: rm -rf build: forbidden tz=x rm -rf build: no match rm -fr build: no match prefix rules match tokens, not intent. [link]” [source](https://twitter.com/1853396111794618368/status/2107102818075324928)

#### Other

- Claude Code, 2026-10-16, @ClaudeDevs (X): “@claudedevs nice sandbox... the sandbox is supposed to block *claude* from reading outside the working directory, not the user... [link]” [source](https://twitter.com/138134405/status/2110991652714070352)
- Claude Code, 2026-10-12, r/ClaudeCode (Reddit): “got tired of approving and just gave it dangerously skip permissions” [source](https://www.reddit.com/r/ClaudeCode/comments/1x0lujo/how_much_access_to_your_pc_do_you_give_to_cc/pfd8q3y/)

## Top requests

What users ask to add or change, most asked first. 567 user-weeks ask for something. Requests do not change the Feedback Score. Rule: A separate pass by a large language model reads every counted post and extracts what the user asks the agent or its vendor to add or change, with the criteria it maps to and a short normalised wording; it does not touch the labels or the Feedback Score. A large language model groups the wordings within each criterion (the first criterion the request maps to) into themes, and a second pass merges themes that ask for the same change under different criteria; a merged theme sits under the criterion most of its requests map to, and code counts it once. A theme counts distinct user-weeks that ask for it, per agent; across agents, one user-week per agent. Themes asked in fewer than 2 user-weeks, and requests that share no theme, are not shown. Examples: up to 3 posts per theme from different users, without slurs: whole posts of 60 to 450 characters with at least 8 words beyond handles and links, posts of at most 280 characters first, then the newest.

| Rank | Request | User-weeks | Posts | Agents (user-weeks) |
|---|---|---|---|---|
| 1 | Fewer permission prompts overall | 69 | 69 | Google Antigravity 22, Claude Code 19, OpenAI Codex 18, OpenCode 5, Cursor 4, GitHub Copilot 1 |
| 2 | Auto and bypass modes actually honored | 52 | 53 | Claude Code 19, Google Antigravity 18, OpenAI Codex 8, Cline 2, Kiro 2, Cursor 1, Devin 1, Pi 1 |
| 3 | Confirmation before risky actions | 48 | 48 | Claude Code 16, OpenAI Codex 9, Cursor 8, Google Antigravity 5, OpenCode 4, GitHub Copilot 3, Cline 1, Devin 1, Pi 1 |
| 4 | Persistent always-allow approvals that stick | 45 | 46 | Google Antigravity 20, Claude Code 10, OpenAI Codex 8, Cursor 4, OpenCode 2, Kiro 1 |
| 5 | Fully autonomous mode without prompts | 36 | 39 | Google Antigravity 16, Claude Code 12, OpenAI Codex 5, Devin 1, Kiro 1, OpenCode 1 |
| 6 | Granular configurable permission controls | 35 | 35 | Google Antigravity 12, Claude Code 7, OpenAI Codex 7, GitHub Copilot 2, Cursor 2, Pi 2, Kiro 1, OpenCode 1, Zed 1 |
| 7 | Audit trail of agent actions | 34 | 34 | Claude Code 9, OpenAI Codex 8, Cursor 5, OpenCode 4, Google Antigravity 3, Pi 2, Cline 1, Devin 1, Factory 1 |
| 8 | Add an auto-approve mode | 28 | 28 | Google Antigravity 22, OpenAI Codex 3, Claude Code 2, Cline 1 |
| 9 | Model-reviewed auto-approval classifier | 24 | 25 | Google Antigravity 12, Claude Code 5, OpenAI Codex 4, GitHub Copilot 1, OpenCode 1, Pi 1 |
| 10 | Restrict agent to project folder | 22 | 22 | Google Antigravity 5, Claude Code 5, OpenAI Codex 5, Cursor 2, OpenCode 2, Devin 1, Kiro 1, Pi 1 |
| 11 | Skip prompts for low-risk read-only commands | 21 | 21 | Google Antigravity 11, Claude Code 4, Kiro 3, OpenAI Codex 2, OpenCode 1 |
| 12 | Less restrictive auto mode classifier | 19 | 20 | Claude Code 17, OpenAI Codex 2 |

### 1. Fewer permission prompts overall

- Google Antigravity, 2026-10-18, @antigravity (X): “@antigravity what fuckass harness is this. according to antigravity cli logic i have to sit in front of computer all the time and press "always allow" permission to each and every commands in the universe” [source](https://twitter.com/1135175156576313344/status/2111833595690279155)
- Claude Code, 2026-10-16, @ClaudeDevs (X): “i am tired of pressing this button. @claudeai @claudedevs you don't have to remind me every second. [link]” [source](https://twitter.com/1973082182324215808/status/2111118594772013413)
- Google Antigravity, 2026-10-15, @antigravity (X): “who the fuck designed this pos @antigravity ? keep asking for permissions, how does one even use this crap ?” [source](https://twitter.com/49987760/status/2110777208553996798)

### 2. Auto and bypass modes actually honored

- OpenAI Codex, 2026-10-18, X search: OpenAI Codex, Codex CLI, Codex app (X): “also, when using codex cli, i am concerned that even if it is automatically approved when "approve for me" is enabled, i still receive a notification waiting for approval.” [source](https://twitter.com/1188829372918026241/status/2111922910193656089)
- Claude Code, 2026-10-18, @ClaudeDevs (X): “@claudedevs i wonder if you guys run the permissions-theatre claude you guys serve to the public... seriously, its such a pain to use your product. even with yolo and all the permissions set loosely. learn from @bot -- let it rip” [source](https://twitter.com/1930175775870988289/status/2111673127533265104)
- Google Antigravity, 2026-10-15, @antigravity (X): “why can't @antigravity at least fix the permissions issue where it still prompts even on allow all/turbo. like wtf? almost feels like it's on purpose now.” [source](https://twitter.com/58914498/status/2110544401768325505)

### 3. Confirmation before risky actions

- Claude Code, 2026-10-16, @ClaudeDevs (X): “@itsgoharr @claudedevs agreed. let it fill the cart, then stop at any buy, send or delete button until a person clicks it.” [source](https://twitter.com/1620455035661320192/status/2110933446591655949)
- Cursor, 2026-10-11, r/cursor (Reddit): “except this saw decided to cut the whole bench. guard's going back on with approval for every shell command, and i learned file history and restore points cover a lot less than you'd think.” [source](https://www.reddit.com/r/cursor/comments/1x3az20/cursor_agent_ran_a_recursive_rmdir_from_c_and/pfaomjl/)
- OpenAI Codex, 2026-10-11, r/codex (Reddit): “need to tell it to not open cowork/codex tasks unless you explicitly approve it via a click gate. it isn't intended to use tools, access mcp(s), etc. in the chat interface. it calls upon codex/cowork to do so.” [source](https://www.reddit.com/r/codex/comments/1x37qmk/chat_counting_towards_usage/pf8j0r7/)

### 4. Persistent always-allow approvals that stick

- OpenAI Codex, 2026-10-10, r/codex (Reddit): “it seems that every time a new version of the same app under development is launched, the permissions need to be granted again. beyond this, the agent may want to write scripts so it can observe the app's ui, and each script needs to be granted permission each time it is changed.” [source](https://www.reddit.com/r/codex/comments/1x242zs/grant_macos_permissions_automatically/pez5kz2/)
- Claude Code, 2026-10-07, @ClaudeDevs (X): “@joshua_wd @claudedevs most revolve around gh. “reviews failed, may i repush?” “sorry, your confirmation in this session doesn’t suffice, say ‘yes you can repush’ in that thread”” [source](https://twitter.com/1888643690085691392/status/2107879653415514616)
- Google Antigravity, 2026-10-06, @antigravity (X): “@adhidesign @googledeepmind @antigravity i saved all the important commands to “always allow” but it still keep asking for permissions.” [source](https://twitter.com/776241628373774336/status/2107493014365237505)

### 5. Fully autonomous mode without prompts

- Claude Code, 2026-10-14, @ClaudeDevs (X): “@bcherny @claudedevs "bypass permissions" means i dont want to be asked such things [link]” [source](https://twitter.com/1960005103617708032/status/2110195299520242088)
- Claude Code, 2026-10-10, r/ClaudeCode (Reddit): “confused how a 2 trillion dollar company can't get the concept that bypass permissions should do exactly that. is the setting "bypass \*some\* permissions\*? no.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x2effg/how_to_fix_cc_still_asking_for_permissions_with/)
- Google Antigravity, 2026-10-10, @antigravity (X): “@antigravity can you guys please in the anti gravity app and the ide add a auto accept or by pass permission in the conversation. every other ai model has it why dont you ?” [source](https://twitter.com/1970908528559738880/status/2109002090467000704)

### 6. Granular configurable permission controls

- Claude Code, 2026-10-13, r/ClaudeCode (Reddit): “codify governance in yaml or json format for deterministic auth permissions and execution gating” [source](https://www.reddit.com/r/ClaudeCode/comments/1x4b1ue/it_finally_happened_to_meclaude_accidentally/pggk3de/)
- Claude Code, 2026-10-13, @ClaudeDevs (X): “@demetriuszhomir @claudedevs funny, i want the opposite friction. approval on threads is annoying, but approval on anything that texts a buyer is the only reason i sleep. wish the prompts were per action type, not per app.” [source](https://twitter.com/1182664398999044096/status/2110111859516854566)
- OpenCode, 2026-10-09, r/opencodeCLI (Reddit): “i just want to have more control over what they are doing. omo-slim just don't give me that much of control. but great idea - i could build in some templates for basic agent jobs.” [source](https://www.reddit.com/r/opencodeCLI/comments/1x0kky4/do_you_still_use_ohmyopencode_slim_on_opencode_v2/pevyasu/)

### 7. Audit trail of agent actions

- OpenAI Codex, 2026-10-16, r/codex (Reddit): “i'd want writes outside the paths the task named flagged first, plus .env, anything under .git, lockfiles and ci config. formatter churn and generated files inside the named paths would be noise for me. if those raise alerts i'll end up skipping all of them.” [source](https://www.reddit.com/r/codex/comments/1x7f1t0/built_a_small_local_tool_with_codex_to_check/ph46vvo/)
- Claude Code, 2026-10-06, r/ClaudeCode (Reddit): “"seatbelt, not a sandbox" is the right label, and putting it in the readme is rarer than the tool. does it keep a log of what it blocked? after a week that list would be the interesting part: it's the real picture of what the agent reaches for when nobody's reading the approvals.” [source](https://www.reddit.com/r/ClaudeCode/comments/1wz2pwz/i_approved_an_agents_oc_delete_all_without/pe9fp3j/)
- Pi, 2026-10-06, @pidotdev (X): “@howaboua @pidotdev rules by exact tool name plus arg regex is the right granularity. i'd keep a hard floor under it too: writes outside the task folder and any secret access just fail, no review. then a regex miss hits a wall, and log every allow/deny with the rule that matched.” [source](https://twitter.com/1694929373680336896/status/2107488060929917264)

### 8. Add an auto-approve mode

- Google Antigravity, 2026-10-16, @antigravity (X): “@antigravity also, none of the available commandexecutionpolicy options allow automatic approval of shell commands — you still have to confirm every time 😢 [link]” [source](https://twitter.com/2063470808371179520/status/2110963753063981464)
- Google Antigravity, 2026-10-06, @antigravity (X): “@adhidesign @googledeepmind @antigravity a file viewer, much better browser use, easier full access or auto approve, computer use, sync conversations with the ide version as an option.” [source](https://twitter.com/31341530/status/2107462995307552848)
- Google Antigravity, 2026-10-06, @antigravity (X): “@adhidesign @googledeepmind @antigravity we need auto mode so don’t have to keep approving stuff also inline browser pls” [source](https://twitter.com/1917783661845364736/status/2107454474004410573)

### 9. Model-reviewed auto-approval classifier

- Google Antigravity, 2026-10-17, @antigravity (X): “@antigravity i am sure @neelnanda5 can help u guys train a proper classifier that rejects harmful and riskier tool use calls and deny them automatically!!!” [source](https://twitter.com/842421845546614785/status/2111316870586384756)
- Google Antigravity, 2026-10-08, r/google_antigravity (Reddit): “wheres the auto approve mode for permissions? like using a smaller model to review terminal commands” [source](https://www.reddit.com/r/google_antigravity/comments/1x0etjc/antigravity_2_v2211_cli_v1215_v131_releases/pekanul/)
- Claude Code, 2026-10-03, @ClaudeDevs (X): “@claudedevs feature request: when you present the "we found a potential dangerous 'rm' command" even though i have 'bypass permissions' enabled. it would be cool if i could ask for a independent second and third opinion if it is actually destructive before i make a decision.” [source](https://twitter.com/129557929/status/2106470321109061868)

### 10. Restrict agent to project folder

- OpenCode, 2026-10-16, r/opencode (Reddit): “thanks! have you tried docker specifically with opencode desktop, or does this require switching to the cli? i'd like to keep the desktop ui and conversation history while restricting write access to a single workspace.” [source](https://www.reddit.com/r/opencode/comments/1x7q6ar/how_do_you_prevent_opencode_from_deleting_files/ph6m5qo/)
- Kiro, 2026-10-10, r/kiroIDE (Reddit): “i have a working folder. i don't want complete yolo, i want kiro to respect the boundaries of my project. but it seems i either spend eight hours pressing "accept" or open up my entire like to an agent i don't trust.” [source](https://www.reddit.com/r/kiroIDE/comments/1x283b7/kiro_prompt_spam/pf22klx/)
- Pi, 2026-10-06, @pidotdev (X): “@howaboua @pidotdev rules by exact tool name plus arg regex is the right granularity. i'd keep a hard floor under it too: writes outside the task folder and any secret access just fail, no review. then a regex miss hits a wall, and log every allow/deny with the rule that matched.” [source](https://twitter.com/1694929373680336896/status/2107488060929917264)

### 11. Skip prompts for low-risk read-only commands

- Google Antigravity, 2026-10-18, @antigravity (X): “@antigravity , i use antigravity cli sometimes. i wont say i am a power user of agy. but i am really frustrated by the approval system. literally i had to babysit for tow hours and accepts nearly hundred commands. most of them are basic git and playwrite commands. [link]” [source](https://twitter.com/2039376148438622208/status/2111827089389396199)
- Google Antigravity, 2026-10-13, @antigravity (X): “seriously, @antigravity , you want an approval for each sha1 hash combination? [link]” [source](https://twitter.com/1523035335097262082/status/2109858845543800900)
- OpenAI Codex, 2026-10-09, X search: OpenAI Codex, Codex CLI, Codex app (X): “hey @thsottiaux, could you please improve auto-approvals in codex cli? it keeps asking for approval for trivial actions, which constantly interrupts the workflow. claude code handles this much more smoothly. could you take some inspiration from it? [link]” [source](https://twitter.com/2512945027/status/2108524931772244414)

### 12. Less restrictive auto mode classifier

- Claude Code, 2026-10-18, @ClaudeDevs (X): “auto mode returns "no verdict" on in-repo write/edit that docs say should be auto-approved. is it possible to add the tool to permission and then the auto mode's decision can be overruled if that tool is allowed in permissions? @claudedevs @lydiahallie @bcherny” [source](https://twitter.com/54089550/status/2111667945537433661)
- Claude Code, 2026-10-09, @ClaudeDevs (X): “@claudedevs can u plz fix this issue. even after allowing permissions settings.json, auto mode is blocking actions. this is annoying me now 😭 [link]” [source](https://twitter.com/2267182946/status/2108554119623655725)
- Claude Code, 2026-10-08, @ClaudeDevs (X): “@pgerrits @claudedevs reading local logs feels like a fairly basic thing for auto mode to let through” [source](https://twitter.com/2092845101663842304/status/2108250146735530351)

## Every agent

| Agent | Overall rank | Reading | Customer love | 95% interval | n | Praise | Complaint |
|---|---|---|---|---|---|---|---|
| [Claude Code](https://feedbackbench.com/coding-agents/agents/claude-code.md) | 1 | 1st of 5 | 0.574 | 0.526–0.623 | 464 | 125 | 339 |
| [OpenCode](https://feedbackbench.com/coding-agents/agents/opencode.md) | 3 | 2nd of 5 | 0.514 | 0.487–0.540 | 51 | 13 | 38 |
| [OpenAI Codex](https://feedbackbench.com/coding-agents/agents/codex.md) | 10 | 3rd of 5 | 0.510 | 0.469–0.549 | 313 | 79 | 234 |
| [Cursor](https://feedbackbench.com/coding-agents/agents/cursor.md) | 7 | 4th of 5 | 0.498 | 0.476–0.522 | 53 | 12 | 41 |
| [Google Antigravity](https://feedbackbench.com/coding-agents/agents/antigravity.md) | 14 | 5th of 5 | 0.379 | 0.353–0.406 | 253 | 19 | 234 |
| [Pi](https://feedbackbench.com/coding-agents/agents/pi.md) | 4 | Too few posts | – | – | 21 | 11 | 10 |
| [GitHub Copilot](https://feedbackbench.com/coding-agents/agents/copilot.md) | 9 | Too few posts | – | – | 18 | 4 | 14 |
| [Kiro](https://feedbackbench.com/coding-agents/agents/kiro.md) | 13 | Too few posts | – | – | 12 | 1 | 11 |
| [Devin](https://feedbackbench.com/coding-agents/agents/devin.md) | 2 | Too few posts | – | – | 9 | 0 | 9 |
| [Factory](https://feedbackbench.com/coding-agents/agents/factory.md) | 6 | Too few posts | – | – | 6 | 3 | 3 |
| [Cline](https://feedbackbench.com/coding-agents/agents/cline.md) | 11 | Too few posts | – | – | 6 | 2 | 4 |
| [Amp](https://feedbackbench.com/coding-agents/agents/amp.md) | 5 | Too few posts | – | – | 5 | 3 | 2 |
| [Zed](https://feedbackbench.com/coding-agents/agents/zed.md) | 8 | Too few posts | – | – | 5 | 2 | 3 |
| [Conductor](https://feedbackbench.com/coding-agents/agents/conductor.md) | 12 | Too few posts | – | – | 0 | 0 | 0 |
| [Warp](https://feedbackbench.com/coding-agents/agents/warp.md) | 15 | Too few posts | – | – | 0 | 0 | 0 |
| [Grok Build](https://feedbackbench.com/coding-agents/agents/grok-build.md) | 16 | Too few posts | – | – | 0 | 0 | 0 |
| [Augment Code](https://feedbackbench.com/coding-agents/agents/augment.md) | 17 | Too few posts | – | – | 0 | 0 | 0 |

## Posts

Receipts rule: Up to 5 praise and 5 complaint posts per area and 3 per criterion. Each is a whole post of 60 to 450 characters (700 for areas) with at least 8 words beyond handles and links, that judges the criterion, whose labels are all praise or all complaint, and that contains no slur. Posts that touch the fewest criteria come first, then posts of at most 280 characters, then the newest. A second large language model reads the first 3 candidates per slot and keeps a post only if it clearly praises, or clearly complains about, the agent on that criterion. Links and personal details removed by the source show as marks such as [link].

### Claude Code

- Praise, 2026-10-18, r/ClaudeCode (Reddit): “sandbox and auto mode. dangerously skip is silly when auto exists and barely causes issues. sandboxes limit potential damage.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x9d1yf/it_finally_happened_to_me/phkbz5d/)
- Praise, 2026-10-18, r/ClaudeCode (Reddit): “you can tune permissions in claude so all the constant annoyances never pop up but you can also block certain actions from ever being allowed...like deleting database tables or entire directories.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x9d1yf/it_finally_happened_to_me/phkixd7/)
- Praise, 2026-10-17, r/ClaudeCode (Reddit): “i always run with full permissions. it wasn't so great idea back in the day. i don't see a problem with it now.” [source](https://www.reddit.com/r/ClaudeCode/comments/1x7vi43/whats_yalls_worst_claude_code_incident_deletion/ph8a9s0/)
- Complaint, 2026-10-18, @ClaudeDevs (X): “auto mode returns "no verdict" on in-repo write/edit that docs say should be auto-approved. is it possible to add the tool to permission and then the auto mode's decision can be overruled if that tool is allowed in permissions? @claudedevs @lydiahallie @bcherny” [source](https://twitter.com/54089550/status/2111667945537433661)
- Complaint, 2026-10-18, @ClaudeDevs (X): “@claudedevs i wonder if you guys run the permissions-theatre claude you guys serve to the public... seriously, its such a pain to use your product. even with yolo and all the permissions set loosely. learn from @bot -- let it rip” [source](https://twitter.com/1930175775870988289/status/2111673127533265104)
- Complaint, 2026-10-18, @ClaudeDevs (X): “auto-mode is broken in cc for a while... sounds like nobody is listening although /feedback has been sent @bcherny @claudedevs” [source](https://twitter.com/87314420/status/2111919031678632120)

### OpenCode

- Praise, 2026-09-23, r/ChatGPTCoding (Reddit): “i found that opencode with strict permissions work the best.” [source](https://www.reddit.com/r/ChatGPTCoding/comments/1wnwmia/chatgpt_sol_6_used_local_qwen_for_heavy_lifting/pbmxes9/)
- Praise, 2026-09-18, r/opencode (Reddit): “i use it daily and it doesn't seem stupid to me, it always asks me for permission if it needs to do something destructive. obviously, permissions and instructions need to be configured, otherwise it's like rolling a die.” [source](https://www.reddit.com/r/opencode/comments/1wjjqvr/muse_13_free_formatted_my_drive/paj9wkv/)
- Praise, 2026-09-17, @opencode (X): “@opencode the default permission is denied, which is worth more than adding another tool.” [source](https://twitter.com/1628996445654188033/status/2100472901535179238)
- Complaint, 2026-10-12, r/opencodeCLI (Reddit): “honestly its pretty wierd that i never gave it full access to my pc but never asked for any permission either” [source](https://www.reddit.com/r/opencodeCLI/comments/1vbdp1g/anyone_using_freebuff/pfegcrb/)
- Complaint, 2026-10-10, @opencode (X): “.@opencode what is up with this permissions constantly being set to deny? i remove that and something adds it back in over and over again. [link]” [source](https://twitter.com/1686147506491559936/status/2108759952378466724)
- Complaint, 2026-09-27, @opencode (X): “@opencode beware. that shitty model is asking me to access my ssh file constantly, when it is not necessary to achieve the task.” [source](https://twitter.com/1550629490279284736/status/2104224895609741468)

### OpenAI Codex

- Praise, 2026-10-08, r/ClaudeCode (Reddit): “hmm really? i have an isolated ai workstation and codex is installed locally, running its own user, with password less sudo. it fully manages the system from prompts. seems surprising you can't do that with claude” [source](https://www.reddit.com/r/ClaudeCode/comments/1x0ya1v/holy_fucking_shit_this_is_amazing/pepabli/)
- Praise, 2026-10-07, r/codex (Reddit): “i run claude and codex on yolo mode never ran into any issues, has only been a major productivity booster” [source](https://www.reddit.com/r/codex/comments/1wzycgt/is_it_safe_to_leave_56_sol_high/pefwh00/)
- Praise, 2026-10-06, r/codex (Reddit): “it doesn't bug you for every little change in your file system. only for the most serious changes.” [source](https://www.reddit.com/r/codex/comments/1wzbhgy/please_tell_me_this_isnt_actually_the_reason_were/peat99o/)
- Complaint, 2026-10-18, X search: OpenAI Codex, Codex CLI, Codex app (X): “also, when using codex cli, i am concerned that even if it is automatically approved when "approve for me" is enabled, i still receive a notification waiting for approval.” [source](https://twitter.com/1188829372918026241/status/2111922910193656089)
- Complaint, 2026-10-16, r/codex (Reddit): “that's the way, i prefer isolated, backed up vm and separate git repo upstreams with full access than this whole approval and auto-review thing.” [source](https://www.reddit.com/r/codex/comments/1x78qni/sol_61_high_doesnt_follow_system_instructions/ph297xg/)
- Complaint, 2026-10-15, r/codex (Reddit): “whats slowing me down is gpt's utterly broken ass sandbox. im constantly fighting with it.” [source](https://www.reddit.com/r/codex/comments/1x6sshh/whats_slowing_you_down/pgy60qj/)

### Cursor

- Praise, 2026-09-25, r/cursor (Reddit): “not even going to click that cursor gives you a confirmation prompt when working outside project files pebcak and reading that thread would be a waste of my valuable vibecoding time” [source](https://www.reddit.com/r/cursor/comments/1wq0bdq/cursor_wiped_out_a_guys_entire_drive/pc10kig/)
- Praise, 2026-09-02, r/cursor (Reddit): “just run cursor in the auto review mode and not yolo mode it will flag actions that might have unintended side effects very reliably and ask you” [source](https://www.reddit.com/r/cursor/comments/1w5p5xl/whats_actually_stopping_cursor_from_running/p7gwvf4/)

### Google Antigravity

- Praise, 2026-10-13, r/google_antigravity (Reddit): “i'm a claude code and codex power user but i also have set up agy cli.. it is pretty much the same as claude code and works with -dangerously-skip-permission since day one, what do you need that "autothing" for?” [source](https://www.reddit.com/r/google_antigravity/comments/1x4rpn7/auto_mode_released/pggczie/)
- Praise, 2026-10-06, @antigravity (X): “@vimalbudsz @adhidesign @googledeepmind @antigravity it has that tho. i turned it on and it auto proceeds with everything with me doing anything” [source](https://twitter.com/1564291803616002050/status/2107420938425839711)
- Praise, 2026-09-27, @antigravity (X): “@antigravity the approval step is what sells it honestly. most tools say theyll "think" then just run wild with whatever they guessed.” [source](https://twitter.com/500606751/status/2104064825836134536)
- Complaint, 2026-10-18, r/google_antigravity (Reddit): “sometimes i have to wait a min or two after switching to turbo before it stops asking for permission.” [source](https://www.reddit.com/r/google_antigravity/comments/1x9asl0/antigravity_turbo_mode_asking_for_permission/phjy79h/)
- Complaint, 2026-10-18, @antigravity (X): “@antigravity , i use antigravity cli sometimes. i wont say i am a power user of agy. but i am really frustrated by the approval system. literally i had to babysit for tow hours and accepts nearly hundred commands. most of them are basic git and playwrite commands. [link]” [source](https://twitter.com/2039376148438622208/status/2111827089389396199)
- Complaint, 2026-10-18, @antigravity (X): “@antigravity what fuckass harness is this. according to antigravity cli logic i have to sit in front of computer all the time and press "always allow" permission to each and every commands in the universe” [source](https://twitter.com/1135175156576313344/status/2111833595690279155)

### Pi

- Praise, 2026-09-01, r/PiCodingAgent (Reddit): “my pi never touch my code because i put in agents md file "never modify code without asking user first ("if it works, don't touch it")" im glad because pi will always ask permission before touching my code” [source](https://www.reddit.com/r/PiCodingAgent/comments/1w3lyr7/pi_is_overeager_and_cave_man_question/p749u9v/)
- Praise, 2026-09-06, @pidotdev (X): “i've been using @chatgpt astra in @pidotdev. it's almost like having a plan mode. astra asks for confirmation before performing certain tasks (not all the time, unlike a native harness). it feels a lot like the "approve for me" mode in other harnesses, even though pi is left in its default "yolo" mode with no gatekeeping extensions installed. so far, it has been just the right amount of cautious. not bad.” [source](https://twitter.com/715543/status/2096404380744380478)
- Praise, 2026-09-06, @pidotdev (X): “i've been using @chatgpt astra in @pidotdev. astra asks for confirmation before performing certain tasks (not all the time, unlike a native harness). it feels a lot like the "approve for me" mode in other harnesses, even though pi is left in its default "yolo" mode with no gatekeeping extensions installed. so far, it has been just the right amount of cautious. not bad.” [source](https://twitter.com/715543/status/2096404483764859094)
- Complaint, 2026-10-02, r/PiCodingAgent (Reddit): “i am running ornith1.5-9b and i am scared that it could do something stupid to my pc, so i installed pi-permission system and let claude create me a file with all tools and allow/ask/deny settings. the thing is that this extension isn't perfect (allow always doesn't work) and that i have to allow some command i don't even know about every 10seconds. do you guys give full permissions, do you only block extremely dangerous stuff?” [source](https://www.reddit.com/r/PiCodingAgent/comments/1wvxvio/do_you_give_all_permissions_to_your_agent/)

### GitHub Copilot

- Praise, 2026-09-04, r/GithubCopilot (Reddit): “swap over to the 'copilot' host, and use assisted permissions. way better.” [source](https://www.reddit.com/r/GithubCopilot/comments/1w78bm8/vscode_autopilot_is_too_auto/p7t0pb3/)
- Complaint, 2026-09-17, r/GithubCopilot (Reddit): “now have 100 software, platform engineers, front end devs and artists on business and have the same problem. cli has some permissions. ides others. github copilot app others again. organisations claim to provide granular control, but we're just not experiencing it.” [source](https://www.reddit.com/r/GithubCopilot/comments/1win2b6/github_copilot_is_a_nightmare_for_enterprises/pabr4iq/)
- Complaint, 2026-09-13, @GitHubCopilot (X): “oofduh, switching from working on personal projects in @openaicodexcli to work projects in @githubcopilot is painful. a lot of hand holding and button pushing.” [source](https://twitter.com/1632699243231051777/status/2099227015815512232)
- Complaint, 2026-10-02, r/GithubCopilot (Reddit): “but that's what i'm saying, manual sounds like what it was doing was before this latest update. that's what i would want. now unless i have it on allow all, it asks to allow every file edit. i can't even approve that command anymore, there's no button to do it. assisted errors immediately that it can't figure out whether editing a file should be approved. 😂” [source](https://www.reddit.com/r/GithubCopilot/comments/1wvfmpt/copilot_update_asks_permission_for_every_file_edit/pdbkk25/)

### Kiro

- Complaint, 2026-10-10, r/kiroIDE (Reddit): “i have a working folder. i don't want complete yolo, i want kiro to respect the boundaries of my project. but it seems i either spend eight hours pressing "accept" or open up my entire like to an agent i don't trust.” [source](https://www.reddit.com/r/kiroIDE/comments/1x283b7/kiro_prompt_spam/pf22klx/)
- Complaint, 2026-10-08, @kirodotdev (X): “i can't believe it is possible to make a app worse then antigravity whoever develops @kirodotdev should be tried for crimes against humanity. [phone] allows in the first 5 minutes of use and no way to turn off this sandbox garbage.” [source](https://twitter.com/1840564346138624000/status/2108333972484763679)
- Complaint, 2026-10-06, @kirodotdev (X): “@shudufhadzorsa @kirodotdev lmao every thing it does needs approval, even a simple find 🤣” [source](https://twitter.com/733364996722307073/status/2107310037928378803)

### Devin

- Complaint, 2026-09-18, @DevinAI (X): “@januarycomputer @jjacky i paid 20 bucks to try @devinai and haven't used any of it because the smart permissions doesn't work in the desktop interface, it kept stopping to ask approval for nothing, and i can't be fucked to fiddle with it and just cutting my losses.” [source](https://twitter.com/46284019/status/2100824388212035795)
- Complaint, 2026-09-15, @cognition (X): “man @cognition’s devin’s auto permissions feels sooo 2025 :(” [source](https://twitter.com/1521942376880951296/status/2099662193872794100)
- Complaint, 2026-09-14, @cognition (X): “@thesherlocker @cognition i tried the desktop because the max plan says “increased usage” instead i had to sit there any babysit commands because apparently it can take itself out of bypass mode - switched back to cli immediately” [source](https://twitter.com/587982527/status/2099594000365990337)

### Factory

- Complaint, 2026-09-11, @FactoryAI (X): “@ssshken @irensaltali @factoryai do you really approve every single one? just thinking about it makes me lose my mind. it asks so many questions. even claude's auto mode wears me out. i'm on the team of `--dangerously-skip-permissions` always for any harness” [source](https://twitter.com/19780871/status/2098433285143621710)
- Complaint, 2026-09-11, @FactoryAI (X): “for the run, yes, every one, because the whole point was counting what a person actually does out of the box. skipping them would have measured my setup instead of the tool. day to day i'd do the same as you. which is its own finding: the default for these is a flow nobody keeps, so the real number is either 54 actions or a flag that turns the guardrails off entirely.” [source](https://twitter.com/1909713300868280320/status/2098500898737528870)
- Complaint, 2026-09-11, @FactoryAI (X): “@irensaltali @yigitkonur @factoryai worth knowing where they go. i ran a single-page week planner through it and planning alone took 41 minutes and 7 of the 50 credits, before any code. most of the friction was permission dialogs, 32 allow clicks out of 54 total actions.” [source](https://twitter.com/1909713300868280320/status/2098413898353217579)

### Cline

- Praise, 2026-09-22, r/CLine (Reddit): “the entire reason i use cline in the first place is because it has light guardrails that let you get straight to building.” [source](https://www.reddit.com/r/CLine/comments/1wnluat/qwen_38_flash_next_broke_out_of_plan_mode_vscode/pbgmpyg/)
- Complaint, 2026-09-18, @cline (X): “@cline is being dumb. "proceed while running" shouldn't even show up when it's on auto-approve. and, it's "whilst". "while" is a period of time, as in "i'll be a while"” [source](https://twitter.com/1416864353131765762/status/2101021865888383202)
- Complaint, 2026-10-15, @cline (X): “i also found websocket authentication bypass and auto approval bypass, running cmds in plan mode in @cline sdk would anyone from the team like to connect?” [source](https://twitter.com/1956608648840429568/status/2110824525822824920)
- Complaint, 2026-10-02, r/CLine (Reddit): “yep, tested it today, got the same problem, the ui doesn't seem very feature complete yet. one other big thing was permission management. it was in yolo mode basically and that was going so fast i was a bit worried” [source](https://www.reddit.com/r/CLine/comments/1wvrsac/cline_desktop_toggle_to_act_mode/pdg769a/)