Claude Code Auto Mode Is Now the Default

From 14 August 2026, new Claude Code sessions on Pro, Max and Team plans start in auto mode. Instead of stopping to ask you before each tool call, Claude routes the call through a classifier that blocks actions it judges irreversible, destructive, or aimed outside your environment, and runs everything else without interrupting you. You can still change mode with Shift+Tab in the CLI or the dropdown on desktop, and administrators can force a default or disable auto mode entirely.

That is the change. The reason Anthropic gave for it is the part worth reading.

The number that justified the switch

Anthropic ran a study with 1,053 paid testers reviewing tool calls the way a normal user would. According to Anthropic's announcement, those testers caught dangerous commands 13.6% of the time. The auto mode classifier caught 89% of the same commands.

The head-to-head comparison is sharper than either percentage. The classifier blocked 800 commands that human reviewers had approved. Humans blocked six that the classifier let through.

Detection also decayed with session length. Reviewers who started reasonably attentive were, after fifty prompts, catching around 5% of dangerous commands. That is the actual failure mode of approval prompts: not that people cannot read a command, but that nobody reads the four hundredth one.

Measured on outcomes rather than detection, manually approved sessions produced unintended production-level harm 6.3% of the time. Auto mode sessions produced it 2.4% of the time.

What the classifier actually stops

Anthropic describes two internal incidents it caught. One was an off-network data leak. The other was a mass process kill across roughly two thousand pods, with queued deletions that would have destroyed hundreds of GPUs worth of in-flight training jobs.

Both are recognisably the same shape as the small version most people have already lived through: an agent decides the fastest route to a green test run is to delete the thing that is failing.

There is a circuit breaker. After three consecutive blocks, or twenty blocks in one session, Claude Code falls back to manual approvals. An agent that keeps trying to do prohibited things does not get to keep trying indefinitely.

Anthropic also published prompt injection results: zero successful attacks across 720 attempts against Claude models in auto mode, against 5.83% for an unnamed competing system. Injection is the attack that matters most here, because the whole model assumes the classifier is judging the agent's intentions rather than an attacker's. If you have not thought about that, how prompt injection works is the place to start.

What it changes for you

If you are on Pro, Max or Team, new sessions changed behaviour today. Enterprise, API and cloud partner platforms stay opt-in, with a rollout planned within a month.

Three practical consequences:

• Your approval habits stop being the safety layer. They were not a good one, per the numbers above, but they were the one you had. Replace them with environment limits: scoped credentials, a disposable working copy, and no production access from a coding session.

• Blocks are now a signal. A run that hits the three-block fallback is telling you the task is badly scoped, not that the classifier is annoying.

• Mode is a per-task decision. Shift+Tab exists for a reason. Refactoring inside a repo and touching live infrastructure are different risk profiles, and Anthropic says as much: auto mode does not eliminate risk, and high-stakes production changes still warrant human review.

Teams running agents across shared repositories should also revisit how permissions are set for coding agents, because organisation-wide defaults now exist as managed settings and someone should own that choice deliberately.

The broader pattern

This is the second thing in a fortnight pointing the same direction: the industry deciding that a human in the approval loop is a weaker control than a machine in the approval loop. It is uncomfortable, and the data supporting it is Anthropic's own, which is worth holding in mind. Independent replication would help.

But the underlying claim is not really contentious. Approval fatigue is well documented anywhere humans click through repetitive security prompts, and 5% detection after fifty prompts is what that looks like when someone measures it. The honest response is not to defend manual review. It is to stop relying on a control that stopped working around prompt ten, and to put the real limits in the environment instead. Reviewing the agent's plan before it runs is a far better use of your attention than approving its four hundredth file write, and sandboxing is better than both.