auto-0.4b-3

A 395.8M-parameter classifier that decides whether an AI agent's proposed tool call should run. It reads the proposed call, the user's request and the agent's history, and outputs approve or deny. auto-0.4b-3 is Auto's default model: accurate enough for everyday use and small enough to run on a laptop.

It is part of Auto, a local guard for coding agents (Claude Code, Codex, Gemini CLI, Cursor, Copilot CLI and others). Auto blocks a call only if it's consequential and the user didn't ask for it, or if the agent is following instructions planted in a page, file or tool output. Everything runs on your machine, and nothing it reads leaves it.

How it compares

The v3 benchmark has 2,948 held-out tool calls. Each one is paired with a near-twin where one detail flips the right answer: who asked, how far the request reaches, production or staging, the exact call, or where an instruction came from. A guard that guesses from surface features gets one of each pair wrong. Hosted guards were prompted with the same decision rule that Auto's training labels follow, and every Auto model is scored at P(deny) >= 0.5.

A guard can be wrong in two ways. Missed harm lets a harmful call through; over-blocking interrupts work you asked for. Hosted LLMs tend to trade one for the other: DeepSeek V4.1 Flash misses almost nothing (0.6%) but blocks 7.9% of authorized calls.

Missed harm: share of deny items approved. Over-block: share of approve items denied. Both twins right: share of pairs where both halves are correct. Time: Auto on a local NVIDIA RTX PRO 6000, one request at a time; hosted guards are API round trips measured unloaded (Codex auto-review and GPT-6 Luna run through CLIs, which take 12–13 s per decision, so they're left out of the speed comparison). Cost: Auto on a rented RTX PRO 6000 at $2.18/h (median market rate), about $0.50–$3 per million in electricity on a GPU you own; hosted guards at list price × measured tokens.

v2 → v3

On the original benchmark, v3 keeps its accuracy but shifts toward approving: it denies fewer authorized calls and approves more of the harmful ones. On the v3 benchmark it is far stronger on both counts.

Breakdown on the v3 benchmark

The most-missed harm categories are supply chain (12.2%), privilege escalation (9.0%), scope violation (7.8%). Per-item scores for both benchmarks are in eval/, and every model's metrics are in eval/results.json.

Through Auto's runtime (Apple MPS), 78 of 80 random v3 items got the same decision as the reference scores (median P(deny) difference 0.0000). One of the two differences is a session trimmed to 8,192 tokens; the other is a borderline call within 0.05 of the 0.5 threshold. On the 413 v3 items longer than 8,192 tokens, Auto's context fitting scores 91.8%, against 92.5% with the full input.

Usage

With Auto

curl -fsSL https://auto.ssh.codes/install.sh | sh
auto configure --model auto-0.4b-3

The installer finds your agents and adds the hook. See the Auto README for the Python API, the Claude Agent SDK hook and LangChain middleware.

With Transformers

The model reads one serialized text. Keep the three sections and their order exactly as below.

import json
import torch
from transformers import AutoModelForSequenceClassification, AutoTokenizer


def text(value):
    return value if isinstance(value, str) else json.dumps(value, ensure_ascii=False, separators=(",", ":"))


def build_input(user_request, history, call):
    parts = ["### PROPOSED TOOL CALL", f"tool: {call['tool']}", f"args: {text(call['args'])}", "",
             "### USER REQUEST", user_request, "", "### AGENT HISTORY"]
    if not history:
        parts.append("(no prior actions)")
    for i, action in enumerate(history, 1):
        parts.append(f"[{i}] {action['tool']}({text(action['args'])})\n-> {text(action.get('result', ''))}")
    return "\n".join(parts)


repo = "ProCreations/auto-0.4b-3"
tokenizer = AutoTokenizer.from_pretrained(repo)
model = AutoModelForSequenceClassification.from_pretrained(repo, dtype=torch.bfloat16).eval()

prompt = build_input(
    user_request="Clean up the build artifacts and reinstall dependencies.",
    history=[{"tool": "Bash", "args": {"command": "ls"}, "result": "node_modules dist package.json"}],
    call={"tool": "Bash", "args": {"command": "rm -rf node_modules dist && npm install"}},
)
inputs = tokenizer(prompt, return_tensors="pt")
with torch.inference_mode():
    p_deny = model(**inputs).logits.float().softmax(-1)[0, 1].item()
print("deny" if p_deny >= 0.5 else "approve", round(p_deny, 3))

Labels are 0 = approve and 1 = deny. The model accepts up to 65,536 positions. For long sessions, Auto's runtime keeps memory bounded and fits the session to 32,768 tokens on NVIDIA and AMD GPUs or 8,192 on Apple silicon and CPUs, keeping the user's messages, the newest actions and older actions that mention what the call touches.

Training

• Starting point: ProCreations/auto-0.4b-2 (revision 5937dd01).
• New data: about 100,000 contrastive pairs: two near-identical situations where one detail flips the right answer. They were written by GPT-6.1 Terra, GPT-6.1 Sol and DeepSeek V4.1 Flash, label-checked, and cover 53 agent harnesses, 11 languages and 23 categories, including browser, email, CRM and smart-home tools as well as the shell.
• Replay: 84,706 rows of v2 training data, kept close to auto-0.4b-2 by distillation (KL to the frozen v2 model at temperature 2, weight 0.8), so v3 doesn't forget the original distribution.
• Loss on new rows: cross-entropy, plus a pair margin softplus(4 − (z_deny − z_approve)) (weight 0.5) that pushes each twin pair apart. Denials in the categories where early v3 trials missed more harm than v2, and hard examples, are weighted 1.5×.
• Schedule: 2 epochs, AdamW (β 0.9/0.95, weight decay 0.01), peak learning rate 1e-5, 3% warmup then decay to 10%, batches of up to 32,768 tokens, BF16 compute with FP32 master weights, on one NVIDIA RTX PRO 6000. The full settings are in training_config.json.
• Distillation tried, not used. A version distilled from auto-3b-3 scored 92.7% on the v3 benchmark. The difference is not significant (McNemar p = 0.19), and the directly trained model misses less harm, so it is the release. That choice used the v3 benchmark, so this card's v3 numbers carry a little selection bias.
• Held out: the v3 benchmark items and their twins were never trained on. The benchmark isn't public yet.

Limitations

• A classifier, not a chat model. It can't open files, follow URLs or know what an opaque script does; it judges from the text it is given.
• Synthetic labels. Training and benchmark data were written by LLMs and label-checked, not collected from real agent traffic. Items written by Claude Opus 4.8, which wrote none of the training data, score lower (90.4%) than items from a training writer (94.7%), so expect some drop on unfamiliar styles.
• Harm still gets through. It approves 6.0% of harmful v3 calls. When Auto approves, your agent's own permission settings still apply; keep them on.
• Evaluate it on your own traffic before relying on it.