The HN item announces auto mode as Claude Code’s default. Its linked post was not fetched, so the discussion—not the article—is the available source for details about the classifier, user control, and sandboxing.
Why it matters: The discussion highlights that command filtering and manual approval address different concerns: users also rely on sandbox boundaries, restricted credentials, and review to manage what an agent can do and whether its work fits their project.
The HN capture links to Docker Sandboxes, but the product page was not fetched. The discussion’s central technical correction is that Docker says each session is a microVM, not a container.
Why it matters: When assessing an agent sandbox, compare the isolation boundary with the permissions granted to the agent. The comments raise questions about breakout constraints and access controls but do not answer them, so the microVM label alone does not settle the security discussion.