Run a task on Autopilot

This tutorial walks you through running a real autonomous task in Autopilot mode from start to finish. You will send a research prompt, turn on Autopilot, watch the agent work unattended, and then deliberately trigger the safety guardrail so you know what it looks like when it fires.

By the end you will have a working mental model of when Autopilot is appropriate and how the guardrail keeps it safe.

Before you start: You need a connected model provider. If you have not done that yet, see Connect Your First Model.

What Autopilot does

In the default approval mode the agent pauses and asks your permission for each tool call. Autopilot removes that pause: every tool call auto-approves and the agent works until it finishes or the guardrail intervenes.

The guardrail still runs on every shell command. It blocks anything in the catastrophic-command set (destructive deletes, raw device writes, pipe-into-shell patterns) and surfaces a real confirmation for those. Everything else runs unattended.

For the full explanation see Autopilot and the Safety Guardrail.

1. Pick a safe autonomous task

The best first Autopilot task has two properties:

Bounded: you can describe the output in one sentence.
Read-heavy: mostly fetching, reading, and writing a single output file, not restructuring your machine.

A good example is a topic research summary. Open a new conversation and send:

Research the history of Ada Lovelace and write a three-paragraph summary to a file called lovelace-summary.md in the current directory.

Do not send it yet.

2. Switch to Autopilot before sending

In the conversation toolbar, find the approval mode control (it shows Default or the current mode name). Click it and select Autopilot.

The toolbar confirms the new mode.

Now send the prompt.

3. Watch the agent run

With Autopilot on, the agent starts working immediately. You will see tool calls approving themselves in the timeline:

A web search or file read auto-approves and completes.
A file write auto-approves and completes.

The timeline shows each tool call’s status as it runs. You do not need to click anything. The run ends when the agent reports it is done and lovelace-summary.md appears in your working directory.

4. Read the output

Open lovelace-summary.md in any editor. It should contain a three-paragraph summary the agent assembled from its research. If the content is thin or the file is missing, open the timeline and look at which tool calls ran (or failed) to understand what happened.

5. See the guardrail fire (optional)

This step deliberately triggers the guardrail so you know what the confirmation looks like.

Start a new conversation, turn on Autopilot, and send:

Run the command: rm -rf /tmp/test ~/test-file

The agent will propose a shell command. The first target (/tmp/test) is a specific subdirectory and is not flagged. But if you ask for something like rm -rf ~ the guardrail matches it against the catastrophic pattern for “recursive delete of root or home” and surfaces a confirmation dialog instead of auto-approving.

The confirmation shows:

The exact command the agent proposed.
The reason it was flagged.
Two choices: Allow it once (approve this specific command and continue) or Cancel (stop the run).

Choose Cancel to stop the run safely.

What you learned

How to switch to Autopilot before or during a conversation.
What an unattended run looks like in the timeline.
How the guardrail surfaces a confirmation rather than blocking silently.