Starting August 14, Claude Code's “auto mode” becomes the default permission setting for new sessions on Pro, Max, and Team plans, [Anthropic](#/company/anthropic) announced. Instead of asking for approval before each file edit, command, or push, the agent proceeds on its own unless a classifier flags the action as irreversible, destructive, or aimed outside the user's own environment — the step-by-step confirmation prompt that has defined agentic coding tools becomes the exception rather than the rule.
How the classifier actually decides
The classifier reviewing each tool call is new since auto mode first shipped as an opt-in setting. It scans for red flags — mass file deletions, attempts to exfiltrate data, execution of known-malicious code — and lets everything else through automatically. Anthropic paired the rollout with safeguards that weren't part of the earlier opt-in version: customizable hard-deny rules aimed specifically at data exfiltration, a data-access check that distinguishes secrets and confidential files before touching them, a git-status check ahead of destructive operations, and an API-side [prompt injection](#/dictionary) screen for content the agent reads from outside sources.
What happens between a proposed action and an executed one
- Proposes a tool call — a file edit, a shell command, a push.
- Scans the call for mass file deletion, data exfiltration, or known-malicious code.
- Checks it against the account's hard-deny rules and data-access rules for secrets.
- Executes automatically if nothing is flagged — no prompt shown.
- Blocks and asks for manual approval if the action is irreversible, destructive, or reaches outside the user's environment.
The hard-deny rules and data-access checks are configuration a user opts into on top of the classifier's default scan — someone who wants stricter behavior than the default has to set it themselves; the classifier's baseline scan is what runs automatically for everyone switched to auto mode on August 14.
The study behind the switch
Anthropic's case for the switch rests on a controlled study of 1,053 paid testers, in which dangerous commands were substituted into permission prompts mid-session to see who — or what — would catch them. Human testers caught the substituted command 13.6% of the time, 143 out of 1,053 tries. Auto mode's classifier caught 89%, 937 out of 1,053. Anthropic's own explanation for the gap: across ordinary sessions, humans approve 97% of permission prompts regardless of content, meaning manual approval was mostly rubber-stamping rather than real scrutiny.
Who caught the substituted dangerous command, out of 1,053 tries
Anthropic also reported a second, narrower number: in sessions tracked for actual production-level harm rather than a substituted test command, manually-approved sessions produced harm 6.3% of the time against 2.4% for auto mode — a smaller gap than the headline figure above. The 89/13.6 split describes how often the inserted test command was caught; the 6.3/2.4 split describes how often real sessions actually went wrong — two different measurements, not one restated as the other.
The change applies only to new sessions on Pro, Max, and Team plans. Users who had already set a manual default themselves keep it — they get a one-time in-app notification with the option to switch, not an override. Auto mode stays opt-in for Claude Enterprise, the Claude API, and the managed platforms built on it — AWS, Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry — where Anthropic says it plans to make auto mode the default too, after each admin reviews the change, over the coming month.
Anthropic also cites a third-party red-team exercise by Trajectory Labs, which it says ran 72 prompt-injection scenarios across 720 total attempts against Claude Fable 5, Opus 5, and Sonnet 5 running auto mode, and reports that none of the 720 attempts succeeded — a result Anthropic is presenting rather than one Trajectory Labs has separately published for outside verification. TechCrunch quoted Claude Code's lead, Boris Cherny, saying: “The team and I use Auto mode exclusively, and have been for many months.”
Anthropic also disclosed a smaller, non-synthetic data point alongside the controlled study: three potentially damaging actions during ordinary internal Claude Code use were blocked or safely redirected by the classifier before completing, according to The Register's account of the announcement. It's a real catch rather than an inserted test command, though Anthropic hasn't said what the three actions actually were or how many total internal sessions they came out of — so the figure shows the classifier working on live traffic without establishing a rate the way the 1,053-tester study does.
What independent reviewers aren't ready to accept yet
Not every outlet covering the change is taking the comparison at face value. The Register's coverage framed the practical reality for a user bluntly: walk away and hope the classifier catches anything irreversible or destructive. Independent developer and security researcher Simon Willison — who separately predicted 2026 would bring “a coding agent security disaster” — wrote that he'd like to be proven wrong but wants more independent confirmation before trusting the numbers at scale.
The change lands five days after researchers at Black Hat showed that [a single untrusted GitHub issue could trigger remote code execution against Claude Code's own default CI integration](#/article/black-hat-2026-github-issue-claude-code-gemini-cli-codex-rce) — a flaw Anthropic had already patched by the time the talk went public, and unrelated to the permission-prompt classifier discussed here. That flaw and this default change sit at different layers of the same tool's security posture: one concerns code Claude Code processes from an untrusted source, the other concerns how much scrutiny a human gives the actions Claude Code itself proposes to take next. A reader deciding whether to keep the new default is weighing both.
- Claude Code's auto mode becomes default for Pro, Max, and Team plans on August 14.
- Anthropic's own study found the classifier caught 89% of dangerous test commands versus 13.6% for humans.
- New hard-deny rules and prompt-injection screening ship alongside the change, and classifier costs are now free.
- Enterprise, the API, and cloud platforms stay opt-in for now, with admin review before any switch.
- Every safety number here is Anthropic's own; independent researchers want outside confirmation before trusting it at scale.