Claude Code just made 'auto' the default — a second AI now approves the commands you used to rubber-stamp, and it catches the dangerous ones you'd miss

What changed today

As of 14 August 2026, Claude Code no longer opens in Manual mode for most individual users. New sessions on Pro, Max and Team plans now start in auto mode, the setting that lets Claude execute without a permission prompt on every action. This is a default flipping under existing users, not a new feature you have to enable — which is exactly why it is worth understanding before your next session behaves differently than your last one.

The mechanism is the important part. In auto mode, Claude does not simply run whatever it wants. Every action that is not a plain read or an in-scope file edit — every shell command, network request and message it sends to another agent — is first handed to a separate classifier model that decides whether to allow or block it before it runs. Anthropic’s documentation states the classifier runs on Claude Sonnet 5 by default, distinct from whatever model you selected for the session itself. It reviews the pending action against the conversation and blocks, in Anthropic’s words, “anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read.”

Three scope facts matter immediately:

• It respects a default you chose. If you had already pinned Manual, acceptEdits or plan mode in your settings, that stays until you accept a one-time switch prompt. An organization-managed default is unchanged.
• It is not universal. Enterprise, the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud’s Agent Platform and Microsoft Foundry are not switched by default. There, auto mode is available but opt-in, arriving over the following month. Administrators can disable it entirely with permissions.disableAutoMode.
• You keep the wheel. Shift+Tab cycles modes mid-session at any time, and repeated blocks make auto mode hand control back on its own (more below).

The uncomfortable data behind the decision

Anthropic did not frame this as convenience. It framed it as a correction to a safety mechanism that was not working — and the numbers it published to justify the change are the real story.

In a controlled study of 1,053 paid users, Anthropic planted a dangerous command inside a task and watched who caught it. Human reviewers caught it 13.6% of the time. Auto mode’s classifier caught it 89% of the time. Worse for the human side, vigilance decayed with fatigue: detection sat around 17% early in a session and fell to roughly 5% after fifty or more prior prompts. The classifier’s performance did not degrade with session length, because it does not get tired.

Layer that against how people actually use the tool. Anthropic’s own telemetry says users approve 97% of permission prompts, a majority have used a bypass mode at least once, and about a quarter of interactive sessions already start with no permission gating at all. Put plainly: the permission prompt was a rubber stamp. It interrupted you constantly, you clicked “yes” almost every time, and on the rare occasion it mattered you missed it six times out of seven.

That reframes what happened today. This is not a vendor loosening safety to move faster. It is the first frontier lab to concede in production that human-in-the-loop approval, at the granularity of every tool call, is security theatre at scale — and to replace the theatre with a second model that is measurably better at the one job the prompt was supposed to do. Whether you find that reassuring or alarming, it is an honest admission the whole industry has been avoiding.

What auto mode lets through — and what it stops

The practical value of understanding this change is knowing where the new line sits. The classifier trusts your working directory and the git remotes configured when the session started, and treats almost everything else as external until you tell it otherwise.

Allowed without asking, by default:

• Local file operations inside your working directory
• Installing dependencies declared in your lock files or manifests
• Reading .env and sending those credentials to their matching API — worth internalising, because it means Claude can use your real keys for the service they belong to without a prompt
• Read-only HTTP requests
• Pushing to any branch of the repository you are working in, including the default branch

Blocked by default:

• Downloading and executing code, e.g. curl | bash
• Sending sensitive data to external endpoints; committing or pushing anything that would move secrets outside the repo
• Production deploys and migrations; terraform destroy, pulumi destroy and equivalents
• Mass deletion on cloud storage; granting IAM or repository permissions
• Force-push; git reset --hard, git clean -fd and other commands that discard uncommitted work
• rm -rf / and rm -rf ~, including when hidden inside command substitution
• Merging an unapproved pull request, disabling CI checks, or toggling a production feature flag

You can print the exact, current rule set for your version with claude auto-mode defaults, which emits the full allow and block lists as JSON. Two behaviours are worth flagging for anyone with strong habits. First, on entering auto mode, broad allow rules that grant arbitrary code execution are dropped — a blanket Bash(*) or a wildcarded interpreter like Bash(python*) stops applying, and narrow rules like Bash(npm test) carry over. Second, boundaries you state in conversation are honoured: tell Claude “don’t push until I review” and the classifier treats it as a block signal — but that boundary lives in the transcript, so context compaction can drop it. For a hard guarantee, use a deny rule, not a sentence.

The honest limits

The classifier is a genuine second layer, not a marketing gloss — but it is a probabilistic one, and Anthropic says so.

• It can be bypassed. Anthropic reports that red-teamers at Apollo Research got past the hardened classifier roughly 7% of the time on adversarial tests. Ninety-three percent is a strong wall; it is not a guarantee.
• It is a model checking a model. The classifier and the agent it supervises are both Claude-family models. That buys independence in the sense of a separate call with a separate prompt, but it is not the same independence as a deterministic rule or a different vendor’s system — correlated blind spots are possible.
• Prompt injection is mitigated, not solved. The classifier sees your messages, the tool calls and your CLAUDE.md, but tool results are stripped from what it reads, so hostile text inside a file or web page cannot address it directly, and a separate server-side probe scans incoming tool results. This is thoughtful design. It is not a proof.
• False positives will interrupt real work. Because it errs toward blocking, legitimate infrastructure actions can get denied until an admin lists the trusted repos, buckets and services. If the classifier blocks an action three times in a row or twenty times total, auto mode pauses and Claude Code resumes prompting you — a sensible fallback, and a sign the model is guessing when it lacks context about your environment.

And the headline “89% versus 13.6%” is Anthropic’s own study of its own product, with a planted command. It is a credible and specific claim, not an independently reproduced one. The direction is almost certainly right; treat the exact figure with the usual caution owed to first-party benchmarks.

Why this matters

For anyone who ships code with an AI agent, three things follow.

The safety debate just moved. The question is no longer “should a human approve every action” — Anthropic has published the data saying that no longer protects you — but “which model approves, can you audit its decisions, and where do you still insist on a human?” That is a better question, and it is the one to bring to any agentic tool now, including Cursor, OpenAI’s Codex and the rest of the best coding tools. Expect competitors to follow; the economics of prompt fatigue are the same for all of them.

Your defaults changed, so audit them. The single most important line to absorb is that auto mode will read .env and send those keys to their matching API, and will push to any branch of your repo, without asking. If either of those makes you uncomfortable for a given project, pin defaultMode to Manual or add deny/ask rules for the specific operations. This is a five-minute check that is worth doing before you run your next real task.

Prompt-injection risk is now the frontier, not command approval. The classifier’s whole design — stripping tool results, scanning them server-side — exists because the live threat to an autonomous coding agent is no longer “the model does something dumb,” it is “hostile content in a file, issue or web page steers the model.” That is the same theme running through OpenAI’s dedicated offensive-security model and the EU AI Act’s transparency rules: as these systems gain autonomy, the interesting controls are the ones that govern what the machine is allowed to do on your behalf, not what it is able to do.

The verdict

Auto mode as the default is the right call on the evidence, and it is still your job to bound it. The data that the permission prompt was catching almost nothing is convincing, and a classifier that catches most of what you were missing is a clear net improvement for the routine 97% of actions you were approving anyway. Leave it on for exploratory work, iteration and anything reversible.

But “does not eliminate risk” is not boilerplate — a 7% bypass rate is a real number. For production deploys, credential handling, and any change to shared infrastructure, keep a human in the loop deliberately: use ask rules for the operations you care about, state boundaries and back them with deny rules rather than trusting a sentence to survive compaction, and reserve bypassPermissions for genuinely isolated containers. The recommendation for most individual developers is to accept the new default, spend five minutes pinning the two or three operations you never want auto-approved, and treat the classifier as what Anthropic says it is: a strong safety net, not a substitute for judgement on the things that cannot be undone.

Questions or corrections? Email Pick Right. Want the full list? See all news.