Contents
Anthropic announced this week that Claude Code’s auto mode becomes the default for Pro, Max, and Team accounts starting August 14. Enterprise accounts and the Claude API stay opt-in for now, with a default rollout planned there within the month. That is a small configuration flip on paper. What is behind it is a genuinely uncomfortable finding about how humans behave when a coding agent asks permission over and over: they stop reading the question and start reflexively clicking yes.
Anthropic’s own numbers make the case. Users currently approve 97% of permission prompts, up from 93% when auto mode first shipped in March. Working with more than 1,000 testers, Anthropic found humans catch only 13.6% of genuinely dangerous commands buried in a session, against 89% for Claude Code’s classifier running in auto mode. Vigilance degrades with session length too: after 50 prompts, human testers caught just 5% of the dangerous ones. Auto mode was built to replace that rubber-stamping with a model-based classifier that actually reads what it is evaluating every single time, so the switch to default is really Anthropic betting that a machine which does not get tired beats a human who does.
What changed to make this safe enough to default on
Three things stand out from the rollout, beyond just flipping a setting.
Hard denies for data exfiltration. The classifier now refuses to approve anything that sends code, secrets, or other repo contents to an external destination, full stop, no matter how the request is phrased. A developer has to leave auto mode entirely to run that kind of command. Organizations can layer their own hard-deny rules on top for anything they never want an agent doing, regardless of what a user asks for.
Blast-radius awareness before destructive commands. Ahead of something like git reset --hard, the classifier now checks the repository’s actual git status, so it knows what uncommitted work is about to be discarded before it lets the command through. It also checks whether the destination of a git push or pull request is public, private, or trusted, since the same push can be routine or an exfiltration depending purely on where it lands.
A measured drop in prompt-injection misses. Anthropic ran a two-week red-teaming pilot with Apollo Research, injecting synthetic attacks into real workflows. The hardening work dropped the classifier’s miss rate on held-out attacks from 12% to 7%. A separate third-party evaluation by Trajectory Labs found zero of 720 prompt-injection attacks got through Claude models in auto mode, against 19% getting through OpenAI’s GPT-5.6 Sol in Codex’s full-access mode and roughly 6% in its auto-review mode.
There is a backstop built in too: three consecutive denials, or twenty in one session, hands control back to a human and reverts to manual approvals. That matters because a classifier that occasionally blocks something legitimate should cost you a retry, not the whole session.
Try the classifier’s decision tiers
Anthropic’s engineering writeup lays out which actions get auto-approved outright, which reach the classifier, and why. The simulator below walks through a handful of real examples from that writeup, showing which tier each one hits and what the classifier decides. Pick an action to see the reasoning.
About the demo
This mirrors the tiers and example verdicts Anthropic documented in its auto mode engineering post. It runs entirely in your browser against a small fixed script, not a live classifier.Where this leaves teams running Claude Code unattended
The honest framing, and Anthropic says as much in its own engineering post, is that auto mode reduces risk rather than eliminating it. The classifier’s real-overeager-action false-negative rate sits around 17% on Anthropic’s own internal testset, which is a substantial improvement over --dangerously-skip-permissions but not a substitute for a careful human reviewing changes to production infrastructure. For the everyday case, though, the tradeoff Anthropic is making is the right one: most permission prompts were theater long before this announcement, and a classifier that reads every action closely beats a human whose attention has already worn thin by prompt thirty. If you run Claude Code against real repositories today, the practical next step is to check claude auto-mode defaults before August 14 and add your own environment boundaries and hard-deny rules, rather than inheriting the generic defaults on a codebase the defaults were never written for.