Anthropic is making Auto Mode the default permission setting in Claude Code, arguing that its classifier is better at catching dangerous commands than humans who are repeatedly asked to approve them. Starting August 14, Auto Mode will be enabled by default for Pro, Max, and Team users unless a user or administrator chooses another setting.
The change comes after Anthropic studied more than 1,000 testers and found that people approved 97% of permission prompts. Testers caught just 13.6% of dangerous commands, compared with 89% detected by Claude Code’s Auto Mode classifier.
Why Anthropic Is Making Auto Mode The Default
Claude Code traditionally required users to approve tool calls individually, which gave developers direct control over what the coding agent could do. The downside was that long-running sessions could generate a constant stream of permission requests, making it easy for users to approve commands without carefully reviewing them.
Anthropic’s research suggests that is exactly what happens. In its study of 1,053 paid testers, users approved 97% of permission prompts. As the number of prompts increased, their ability to spot dangerous commands dropped even further. After 50 prompts, testers detected only about 5% of dangerous commands.
Auto Mode takes a different approach. Instead of asking the user to approve every command, a separate classifier evaluates tool calls and determines whether an action could be dangerous, destructive, irreversible, or outside the task Claude is supposed to perform.
If the classifier blocks an action, Claude can look for a safer way to complete the task or return to the user for explicit approval. After three consecutive blocks, or 20 blocks in a single session, Claude Code falls back to manual approvals.
Anthropic says this approach should reduce the number of routine permission prompts while making the prompts that do reach users more meaningful. It also makes Claude Code more practical for long-running tasks where constantly monitoring an agent would otherwise be necessary.
The company is also removing the extra token charge associated with the Auto Mode classifier, meaning users will not pay for the small number of additional tokens used to evaluate each tool call.
Auto Mode is not being treated as a blanket safety guarantee. Anthropic has added hard-deny protections for certain actions, including data exfiltration. The classifier can also consider how confidential information is being accessed or shared and whether a Git destination is public, private, or trusted.
It also checks repository status before destructive commands such as git reset --hard, giving the classifier more context about what could be lost. Anthropic has added an API-side check for prompt injection attempts in content Claude retrieves from websites, files, and other tool outputs.
Before the rollout, Anthropic worked with Apollo Research on a two-week red-team test using synthetic attacks in real workflows. The company says the classifier initially missed 12% of the attacks, but that figure fell to 7% after the additional protections were added.
Claude Code Auto Mode Still Needs Human Oversight
Anthropic’s research supports reducing repetitive approval prompts, but Auto Mode still requires human oversight for high-stakes work.
The company recommends keeping a person in the loop for production or otherwise sensitive changes, since a classifier can reduce risk but cannot guarantee every dangerous action will be caught.
In a third-party prompt injection evaluation by Trajectory Labs, Anthropic also compared Auto Mode with OpenAI’s Codex. It reports that none of the 720 attacks against Claude Code in Auto Mode succeeded, while GPT-5.6 Sol in Codex allowed 19% of attacks through with full access and just under 6% in auto-review mode.
The results should be interpreted cautiously, as the tests were commissioned by Anthropic and used specific configurations. Even so, they reflect a broader trend as coding agents gain deeper access to real systems.
Starting August 14, Auto Mode will become the default for Claude Code Pro, Max, and Team users, with Enterprise users able to opt in ahead of a wider rollout across the API and cloud platforms. The shift coincides with Claude Code’s move toward longer, more autonomous workflows, including new cross-session messaging that lets separate sessions share findings and changes.
Overall, these updates point to a system that reduces day-to-day supervision while still maintaining safeguards for potentially high-impact actions.
