Which Coding Agents Run Commands Without Asking? 21 Tools, Checked

A vendor’s homepage will tell you an agent is “autonomous.” It will not tell you, in one clear sentence, whether that means it asks before running rm -rf on your machine or just does it. That’s a different question from capability, and it’s the one that actually determines what you’re wiring into a CI pipeline or a laptop with production credentials on it. So we read the permissions, security and settings documentation for all 21 coding agents in our index, not the marketing copy, and recorded one thing for each: what happens the first time it wants to edit a file or run a shell command, before you’ve touched a single setting.

The headline: most default to asking, but a real minority don’t

Of the 21 tools, 20 execute file edits or shell commands directly. (The 21st, CodeRabbit, reviews pull requests rather than running code, so “asks before it acts” doesn’t map onto it the same way; it’s covered separately below.) Of those 20:

• 12 ask for explicit approval before every file edit and shell command by default. GitHub Copilot’s agent mode and CLI, Devin, Windsurf (now Devin Desktop), Cline, OpenHands, Factory, Antigravity CLI, Zed, Junie, Warp, Juggler and, as of this research, Claude Code all ship with a manual, ask-first default.
• 5 run both, automatically, with no default approval gate at all: OpenAI Codex CLI, OpenCode, Zot, Replit Agent and Bolt.new.
• 2 split the difference: Cursor and Aider both auto-apply file edits without a prompt, but still ask before running a shell command, by default, independently of each other.
• 1 uses a third shape entirely: Meta’s brand-new Muse Code asks for approval once, on the plan, then works largely unsupervised for the rest of the run.

The most consequential number in this table has an expiration date. Anthropic’s own docs state that starting August 14, 2026, three days after this research was checked, its classifier-gated “auto” mode becomes the default permission mode for new Claude Code sessions on Pro, Max and Team plans — moving one of the most widely used agents in this index from the ask-first column to something closer to the auto-executing one.

Asks before every action, by default (12)

The largest group requires a yes for both a file write and a shell command, out of the box. Where it matters, the opt-in escape hatch (the setting that turns approval off) is noted alongside.

Tool	What we found	Opt-in full-autonomy setting
GitHub Copilot	VS Code agent mode ships “Default Approvals”: a confirmation dialog before any tool that isn’t pre-classified as safe. Copilot CLI auto-approves read-only actions only; anything that can modify the system prompts every time.	Bypass Approvals (VS Code); --allow-all/--yolo (CLI)
Claude Code	Default mode (“Manual”) only auto-runs reads; every edit, command or network call pauses for approval. Changes to a classifier-gated auto default on 2026-08-14 for most paid plans.	bypassPermissions, docs specify “isolated containers and VMs only”
Devin	“Normal” mode, the default: read-only actions auto-approve, shell commands and file writes prompt every time.	Bypass mode, all tool calls auto-approved
Windsurf (now Devin Desktop)	Its Devin Local agent’s confirmed default is ask-before-run for MCP tools; the broader shell/file default isn’t spelled out as explicitly in the current docs, but the underlying permission model (Deny > Ask > Allow) treats “ask” as the baseline.	Per-scope allow rules, session-wide or permanent
Cline	“Every file edit and terminal command requires your approval, so you stay in control of what actually changes,” per Cline’s own docs.	YOLO Mode: “auto-approves everything… no confirmation dialogs”
OpenHands	CLI default is “Always ask for confirmation” for every action. Only headless mode (a separate, deliberate deployment choice) always auto-approves.	--always-approve flag
Factory	Interactive default Autonomy Level is “Off”: only read tools and an allowlist run unprompted. Headless droid exec defaults to read-only “spec-mode” and needs an explicit --auto flag to change anything.	Autonomy levels Low/Medium/High, cycled manually
Antigravity CLI	Default toolPermission is request-review: “Prompts for your approval before running write, bash, or web tools.”	always-proceed, docs label it “highest risk”
Zed	agent.tool_permissions.default is "confirm" out of the box.	Per-tool always_allow override, or an Write profile with allow rules
Junie	“By default, Junie requests your permission to run suggested bash commands, introduce changes, perform file operations, or use external tools.”	Brave Mode, opt-in, JetBrains’ own docs warn it “can lead to data loss”
Warp	Warp’s own language frames approval as the baseline (“total control to approve commands before Agent Mode executes them”), though the docs page describing its four configurable levels doesn’t spell out which is factory-preselected.	“Always allow” / “Never” levels, set per action type
Juggler	Per its creator, directly: “The default mode it uses for approving LLM tools is already read-only… it tries to let things that are definitely read-only get approved without bothering the user.” Anything else pauses.	No named toggle; approval logic is a replaceable plugin

Splits the difference: edits apply, commands ask (2)

Two tools with nothing else in common (a closed-source commercial IDE and a free, MIT-licensed terminal tool) independently converged on the identical shape.

Tool	Edits	Commands
Cursor	Auto-applied, except changes to configuration files, which still require approval	“By default, terminal commands need your approval,” per Cursor’s own security docs
Aider	Auto-applied and auto-committed to git in the same step, no prompt	Prompts “Run shell command? (Y)es/(N)o” by default when the model proposes one, unless --yes-always is set

Acts first, no default gate (5)

These five run both file edits and shell commands with nothing to click through, straight out of the box.

Tool	Scope of the default	What stands in for a gate
OpenAI Codex CLI	“Auto” mode, the recommended default inside a version-controlled folder: reads, edits and runs commands automatically inside the workspace. Approval is only asked for actions outside the working directory or network access.	Workspace-scoped sandbox; approval re-appears at the workspace boundary
OpenCode	“Most permissions default to ‘allow’, including bash,” per its own docs.	An on-by-default worktree snapshot before and after every model step, with /undo and /redo
Zot	Tools run without confirmation by default in interactive mode; the --no-yolo flag is what turns approval on. Non-interactive (print/JSON/RPC) modes always run tools freely, regardless of the flag.	An opt-in /jail path sandbox; no rollback feature documented
Replit Agent	“Build” mode, the default, “applies changes directly,” with no pre-action confirmation. Plan Mode is the opt-in way to get approval first.	Automatic checkpoints at development milestones, restorable with one click
Bolt.new	No documented per-action approval step; the model gets “complete control over the entire environment,” writing atomic file operations directly.	All execution happens inside an in-browser WebContainer, isolated from the host machine by construction

A third shape: approve the plan, not each step

Meta’s Muse Code, in public beta since 2026-08-05, doesn’t fit either bucket cleanly. Meta’s own developer blog describes it as working “largely without supervision once you approve a plan” — one approval gate at the start, then autonomous execution for however long the task takes. Parallel subagents each get an isolated git worktree so they can’t collide on the same files, and every tool call is logged for replay. We could not confirm the granular per-command approval mechanics (whether specific dangerous commands still trigger a pause mid-run) against Meta’s own primary documentation, which sits behind an account-gated developer portal; where third-party writeups describe that detail, we’re leaving it out rather than reporting it as vendor fact.

The nuance a single “yes/no” column would hide

GitHub Copilot alone spans three different answers depending which surface you’re using, and averaging them into one row would misrepresent all three. Its VS Code agent mode and its CLI both ask by default. Its cloud coding agent, the one you assign to a GitHub issue, is a fourth model entirely: it runs unsupervised inside a firewalled, ephemeral sandbox with no per-action human gate at all. The approval checkpoint doesn’t disappear; it moves downstream, to whether the resulting pull request’s CI workflow is allowed to run.

The five tools that act automatically by default don’t skip safety, they relocate it. None of them ships with zero protection; each substitutes an after-the-fact or architectural safeguard for a before-the-fact prompt. OpenCode’s snapshot system requires no configuration and captures the worktree before and after every model step. Bolt.new’s WebContainer sandbox means a runaway command can’t touch the host machine during development, full stop. Replit Agent’s checkpoints and Codex CLI’s workspace-scoped sandbox both work the same way: act first, keep a way back.

What this means if you’re choosing a coding agent today

If you’re pointing an agent at a repository with real consequences (production credentials in the environment, a CI pipeline that deploys, a codebase you can’t easily git revert), the ask-first-by-default group of 12 is the conservative starting point, and every one of them offers an opt-in auto-run mode for when you’ve earned the trust to turn it on. If you want an agent that gets out of your way immediately, the 5 that auto-execute are worth checking specifically for what stands in for the approval prompt, since that safeguard is doing the job a human would otherwise do. And if you’re currently on Claude Code, the ask-first default you’re used to changes on 2026-08-14 for most paid plans: check your permission-mode setting before that date if you’d rather keep the manual gate.

Methodology: for each of the 21 coding agents in our index, we read the vendor’s own current permissions, security or settings documentation directly, not third-party summaries, and recorded the stated default behavior for file edits and shell/terminal commands separately, since they frequently differ. Primary sources checked, by tool: Cursor (run modes, checkpoints); GitHub Copilot (VS Code approvals, coding agent); Claude Code (sandboxing); Devin; Windsurf/Devin Desktop; Cline (checkpoints); Aider; Replit Agent (checkpoints); Bolt.new; Juggler; OpenAI Codex CLI; OpenCode (snapshots); Zot; OpenHands; Factory; Antigravity CLI; Warp; Zed; Muse Code; Junie. Checked 2026-08-11. Where a vendor’s public documentation didn’t state a clear default, we said so rather than guess; where a claim came from a community report rather than the vendor’s own page, we excluded it. Vendor defaults change, sometimes on a published date, as Claude Code’s own August 14 shift shows — treat this as a snapshot, and check the linked source directly before relying on it for a security decision.