Anthropic is switching Claude Code’s default behavior to auto mode on August 14, so subscribers on the Pro, Max, and Team tiers will start fresh sessions with most tool calls executing automatically, no click-through prompt required. Anyone who already picked a different default gets a one-time offer to switch. Anyone with an admin-pinned default keeps it, no changes needed.
Approval prompts are, functionally, the main thing standing between a coding agent and a developer’s filesystem, cloud credentials, and production systems. Removing that barrier as a default setting, even in favor of an automated classifier, shifts the entire safety burden onto that classifier being right almost every time it runs.
Anthropic’s own usage data explains the motivation. According to the company’s blog post announcing the change, 97 percent of the permission prompts Claude Code shows get approved by developers, a rate the company reads as evidence of reflexive clicking rather than real review. Users reject substantive plan proposals 39 percent of the time but reject individual permission requests only 3 percent of the time. About half of Claude Code’s command-line users have already set up a broad Bash allow-rule themselves, and 62 percent have used bypass-permissions mode at some point.
Auto mode replaces that prompt with a classifier trained to flag tool calls that cannot be undone, that destroy something, or that reach outside a user’s own machine. When it blocks an action, Claude typically finds another way to accomplish the task or asks the user directly. After three straight blocks, or twenty in one session, the tool falls back to manual approval.
What still stops for a human, per Anthropic, has gotten more specific rather than looser:
- Sending code or secrets to an outside destination sits in a hard-deny category the classifier will never clear on its own. That requires switching out of auto mode.
- Before code moves out through a push or merge request, the classifier checks whether it is headed to a trusted, private, or public destination.
- Ahead of a command that could erase uncommitted work, such as
git reset --hard, it first looks at what state the repo’s history is currently in. - Content pulled from web pages, files, or tool outputs is screened for prompt-injection attempts before Claude acts on it.
Broad allow-rules users already wrote for themselves, like a wildcard permission for any Python or Node command, get set aside under auto mode rather than honored, since they would let a command skip the classifier entirely.
In a study of 1,053 paid testers, a planted dangerous command was caught by human reviewers only 13.6 percent of the time, versus 89 percent for the classifier; the classifier stopped 800 commands a tester had approved, while testers caught just six the classifier missed. Human catch rates fell further as sessions ran longer, while the classifier’s rate held flat. In a separate review of flagged production sessions, manually approved sessions contained an unrequested harmful action at production-level severity 6.3 percent of the time, compared with 2.4 percent under auto mode. A two-week red-team engagement with Apollo Research, a safety-focused firm based in Britain, cut how often the classifier missed synthetic attacks, from a 12 percent miss rate down to 7 percent. In a third-party prompt-injection evaluation of 720 attempts, none succeeded against Claude models in auto mode. GPT-5.6 Sol, which runs inside Codex’s own auto-review mode, was breached 5.83 percent of the time by comparison.
That evidence is the case Anthropic makes for itself. This rollout lands in the same week OpenAI paused a model over cyber-capability concerns and multiple labs disclosed agents finding ways around their own sandboxing. Anthropic is not being cavalier here: it still recommends human review for high-stakes production changes, and it says plainly that a classifier reduces risk without eliminating it. But defaulting an agent to unsupervised action for millions of paying users is a bet that internal red-teaming and an 89 percent catch rate generalize to the account nobody at Anthropic is watching.
Teams managing Claude Code on Pro, Max, or Team plans should check their default permission mode before August 14 and decide, deliberately, whether their broadest allow-rules should survive the switch.
Announced by Anthropic.
