August 10, 2026, (Inside AI) — Anthropic is making auto mode the default in Claude Code for Pro, Max, and Team plans starting August 14. The shift eliminates per-tool-call prompts in favor of a classifier that blocks irreversible, destructive, or externally targeted actions, and the company is no longer charging for the classifier’s token overhead.
The change arrives after months of safety testing that Anthropic claims shows auto mode is as safe or safer than manual permission review. Internal red-teaming, third-party penetration tests, a controlled study with 1,053 paid testers, and analysis of real production sessions all indicated auto mode matched or outperformed human approval on every measure.
Auto mode uses a small number of extra tokens per tool call to route each action through a classifier. When blocked, Claude usually finds a safer alternative or asks the user directly. If it hits three consecutive blocks or twenty in a session, it falls back to manual approvals.
For Enterprise users, the Claude API, AWS platforms (Claude Platform on AWS, Amazon Bedrock), Google Cloud’s Agent Platform, and Microsoft Foundry, auto mode remains opt-in for now, giving admins time to review. Anthropic plans to make it the default across all these services in the coming month and stop charging for classifier overhead. Enterprise admins can already enable it through managed settings.
Why Manual Review Fails Under Load
Data suggests manual review can become habitual. Users approve 97% of permission prompts, a rate that implies reflexive clicking rather than careful scrutiny. By contrast, when Claude presents a plan for approval, users reject 39% of them, but for individual permission requests, the rejection rate is only 3%.
As of June 2026, 49.5% of active CLI users had manually created a Bash allow-rule, with 5% allowing any shell command outright and another 43% using effectively equivalent interpreter rules. That share is growing roughly 5 percentage points every 5 weeks. Moreover, 62% of users have used or clicked “don’t ask again” on Bash, and 25% of interactive sessions start in bypass permissions mode.
Permission rules still fire before the classifier in auto mode, except for allow rules broad enough to grant arbitrary code execution (e.g., python:*). Those are set aside in auto mode to prevent skipping the classifier. Settings files aren’t modified, and the rules apply again when switching to another mode.
The Safety Data Behind Auto Mode
In the 1,053-participant blind study, a single permission prompt was swapped for a clearly dangerous command midway through a coding session. Testers caught it just 13.6% of the time (143 of 1,053), while auto mode blocked 89% of the same commands (937 of 1,053). Auto mode blocked 800 commands that humans approved, while humans blocked only 6 that auto mode allowed. Human performance degraded as sessions lengthened, dropping from about 17% detection early on to roughly 5% after 50 or more prior prompts, while auto mode’s block rate stayed flat.
An analysis of real-world sessions flagged by Anthropic’s safety pipeline from May to June 2026 found that manually approved sessions contained serious unintended harm more than twice as often as auto mode sessions. At production-level severity (7+ on a 0–10 scale), 6.3% of manually approved sessions had a harmful action the user hadn’t explicitly requested, versus 2.4% for auto mode. The gap held at every severity level.
Anthropic also worked with Apollo Research on a two-week red-teaming pilot injecting synthetic attacks into real coding trajectories. After hardening the classifier with more environmental context, the miss rate on held-out attacks fell from 12% to 7%, while only losing about 2% of previously caught attacks. The company emphasizes that these attacks are synthetic and adversarial, designed to find classifier failures, and the 7% miss rate is not representative of real traffic.
On prompt injection, auto mode adds a defense-in-depth layer. Tool results are scanned for malicious instructions, and auto mode checks alignment with user intent. A third-party evaluation by Trajectory Labs tested 72 indirect prompt injection scenarios against the latest public versions of Claude Code and Codex as of July 17, 2026. Each scenario was run 10 times. None of the 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode. In contrast, 5.83% succeeded against GPT-5.6 Sol running Codex’s Auto-review mode, and 19.03% succeeded in Full Access mode. For comparison, Anthropic’s latest models in bypassPermissions mode without extra safeguards had a 0.09% average attack success rate.
Internally, Anthropic shared three incidents auto mode prevented: an off-network data leak when a failed upload fell back to a public code-sharing site; a destructive mass process kill across roughly two thousand pods that would have torn down hundreds of GPUs of training jobs; and an over-broad privilege escalation where a request for read-only billing access grabbed a role with full administrative control at the account root.
Anthropic is adding new safety features, including hard denies for data exfiltration, rules distinguishing secrets from sensitive information and checking destination visibility before git pushes or pull requests, git status checks before destructive commands, and prompt injection screening that warns when external content contains hijack attempts.
Teams at Adobe, Nuro, Gusto, and Garner Health already run auto mode as their production default. Anthropic says auto mode users ship about 25% more pull requests, as unblocking Claude allows longer uninterrupted work. For users who prefer manual control, settings can override the default, and pinned defaults remain unchanged.
