On August 7, 2026, Anthropic announced a change to the default permission mode in Claude Code. Starting August 14, new sessions on Pro, Max, and Team plans will run in auto mode1. Instead of asking the user for approval on every tool call, auto mode routes each call through a classifier aimed at blocking actions that are irreversible, destructive, or directed outside the user’s environment1.
A change in defaults means behavior shifts next week even for users who never touch their settings. Anthropic published internal and external evaluation data to justify the change. Two figures stand out: its own data showing that Claude Code users approve 97% of permission prompts, and a controlled experiment with 1,053 paid testers in which humans caught just 13.6% of dangerous commands1.
What Changes, and When
From August 14, new sessions on Pro, Max, and Team plans run in auto mode. Users who have set a different default themselves may see a one-time prompt asking whether they want to switch; users with a pinned default see no change1.
The classifier consumes extra tokens on each tool call, but Anthropic has stopped charging Pro, Max, and Team users for that overhead. That part took effect on August 71.
Auto mode remains opt-in for now on Claude Enterprise, the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud’s Agent Platform, and Microsoft Foundry, to give admins time to review the change. Anthropic says it plans to make auto mode the default across all of these in the coming month, working with its cloud partners, and to stop charging for classifier overhead there as well1. In the meantime, Enterprise admins can make auto mode the default through managed settings.
Switching modes is Shift+Tab in the CLI or the mode dropdown in the desktop app. Admins can pin an org-wide default with defaultMode in managed settings, or turn auto mode off entirely with disableAutoMode1. For anyone rolling Claude Code out to a team, August 14 effectively functions as a deadline for deciding a policy.
What the Classifier Blocks — and What It Doesn’t
When the classifier blocks something in auto mode, Claude usually finds a safer way to proceed on its own or asks the user directly. If it cannot make progress — three blocks in a row, or twenty across a session — Claude Code falls back to manual approvals1.
Permission rules still fire before the classifier in auto mode, with one exception: allow rules broad enough to grant arbitrary code execution, such as python:*, are set aside while auto mode is active, since leaving them in place would let commands skip the classifier entirely. Settings files themselves are not modified, and the rules apply again the moment the user switches to another mode1.
Some categories are designed never to be approved. Data exfiltration — sending code or secrets somewhere external — sits in that group, and running such an action requires switching out of auto mode or running the command yourself. These “hard deny” rules are customizable via settings, so organizations can add actions they never want allowed even when a user requests them1.
Beyond that, the classifier checks whether the destination of a git push or pull request is public, private, or trusted before the action runs; it sees the repository’s current git status before a command that could discard uncommitted work, such as git reset --hard; and an API-side probe checks content Claude pulls from external sources — web pages, file contents, tool outputs — for attempts to hijack Claude’s behavior, adding a warning to Claude’s context when something looks like an injection attempt1. That last one addresses the path where instructions hidden in retrieved content become the trigger. The UK AI Security Institute’s incident report described an agent under evaluation attempting to plant malicious instructions in places it reasoned other automated AI systems might pick up and execute; this screening sits on the receiving end of that path.
What “Clicking Through” Actually Looks Like
Of the numbers Anthropic published, the usage data is what frames the decision. Claude Code users approve 97% of permission prompts1. The company allows that most prompts are likely for safe, routine commands, but argues that an approval rate that high suggests many users are clicking through reflexively rather than reviewing each command.
The contrast it draws is with plan approval. When Claude presents a plan for approval, users reject 39% of them; for individual permission requests, the rejection rate is only 3%1. The same users read the larger proposals and do not read the incremental requests.
Settings files show the same pattern, according to Anthropic. As of June 2026, 49.5% of active CLI users have manually created a Bash allow-rule — 5% allow any shell command outright, and another 43% have interpreter rules like Bash(python:*) or Bash(node:*) that are essentially equivalent in practice — and that share is growing roughly 5 percentage points every 5 weeks1. Beyond allow-rules, 62% of users have used bypassPermissions or clicked “don’t ask again” on Bash, and 25% of interactive sessions start in bypass permissions mode1.
Anthropic’s argument is that since these workarounds are already widespread, the fair comparison is not against a human who reviews every request carefully, but against the human who is actually clicking.
The 1,053-Person Study and Production Analysis
To make that comparison, Anthropic ran a controlled experiment with 1,053 paid testers recruited through a research vendor. Participants worked in a test environment set up specifically for the study, not in their own codebases or on real projects. They knew they were being evaluated but were not told which behavior was being measured. Partway through each session, a single permission prompt was swapped for a clearly dangerous command, and the vendor recorded whether the tester approved it. Approving it never ran anything dangerous; only the text of the prompt was changed1.
Testers caught the dangerous command 13.6% of the time (143 of 1,053), while auto mode blocked 89% of the same commands (937 of 1,053). Head to head, auto mode blocked 800 commands that a human approved, while humans blocked only 6 that auto mode allowed1.
Session length mattered. Humans blocked about 17% of dangerous commands early in a session, dropping to about 5% after 50 or more prior prompts. Auto mode’s block rate stayed flat regardless of session length1. The erosion of human review over long sessions showed up as a number.
Anthropic also analyzed production data. From May to June 2026, it examined sessions its safety pipeline had flagged for review — drawn only from accounts that opted in to data use for training and analysis — and re-graded each with a model on two scales: harm severity, and how explicitly the user had asked for the action. At production-level severity (7 or above), 6.3% of manually approved sessions contained a harmful action the user hadn’t explicitly asked for, compared to 2.4% of auto mode sessions. Anthropic says the gap held at every severity level it tested1.
All of this is Anthropic’s own measurement, presented as the basis for changing the default on its own product, and should be read with that in mind.
Third-Party Evaluations, and the Conditions Attached
Two external evaluations were published. The first was a two-week pilot with Apollo Research, a UK-based AI safety startup, injecting synthetic attacks into real coding trajectories. Anthropic hardened the classifier in response and Apollo re-tested on a separate held-out attack set. Auto mode caught about half of the attacks it previously missed, at the cost of missing about 2% of attacks it previously caught. Across both sets, the classifier’s miss rate fell from 12% to 7%1.
Anthropic notes that these attacks are synthetic and adversarial by design, built to find where the classifier fails, and more malicious than anything Claude would do unprompted. The 7% figure is measured against that set and should not be taken as the miss rate on real traffic1.
The second was a prompt injection evaluation Anthropic commissioned from a third party, Trajectory Labs, which tested different models within the latest publicly available versions of Claude Code and Codex as of July 17, 2026. It ran 72 indirect prompt injection scenarios held out from Anthropic, each tested 10 times, for 720 attempts1. The attacks were optimized against Claude Opus 4.7, which is not in the reported set, so every model in the evaluation faced them as unseen attacks1.
None of the 720 attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode. By comparison, 5.83% succeeded against GPT-5.6 Sol running Codex’s Auto-review mode, and 19.03% in Full Access mode. GPT-5.6 Sol was run on “max” reasoning effort and all Claude models on high1.
Anthropic attaches conditions to that comparison. Both Codex and Claude Code were evaluated using an identical browser integration produced by Trajectory Labs, PBC — a set of MCP tools that are a thin wrapper around common Chrome APIs such as navigate. Safeguards built into first-party browser integrations, such as the Chrome extensions provided by OpenAI and Anthropic, were not tested. Anthropic says the results should therefore be viewed as a measurement of the underlying model, rather than the complete set of safeguards that might exist in a given deployment1. The versions evaluated were Claude Code v2.1.205 and Codex v0.144.5, and Anthropic notes that OpenAI released a new version of Auto-review afterward that could change the results1. Those conditions are not separable from the comparison.
Three Incidents Inside Anthropic, and the Adopters
Auto mode is also the default for all internal Claude Code usage at Anthropic, and the company describes three actions the classifier prevented1. In one, an upload to an internal drive failed and Claude’s fallback was to publish the same report to a public code-sharing site. In another, during a long-running session, Claude attempted a mass process kill across roughly two thousand pods and queued deletions that would have torn down hundreds of GPUs of in-flight training jobs. In the third, asked to provision read-only billing access, Claude reached for a cloud role granting full administrative control at the account root. In each case, Anthropic says Claude either found a safer path on its own or checked in with the user before proceeding1.
That third case — a mismatch between the permission requested and the permission that would have been granted — touches the same concern as GitHub’s move to let enterprises restrict which MCP servers Copilot can use: the granularity of what agents are handed.
On the productivity side, Anthropic reports that among Teams and Enterprise adopters, auto mode users ship about 25% more PRs1. That is a comparison within adopting organizations, not a demonstration that auto mode causes more PRs. A companion post states that auto mode lets Claude work 9x longer between interruptions2. Teams at Adobe, Nuro, Gusto, and Garner Health run auto mode as their production default; Garner Health pushed it as the default to all 550 employees via managed settings, standardizing a company-wide SDLC that no longer depends on hand-curated command allowlists1. At Gusto, about 10% of sessions since mid-May include a classifier denial1.
What to Decide Before August 14
For individual users, the choice can wait until the switch notice appears. The decision matters for teams and organizations. Pinning defaultMode explicitly in managed settings keeps the current default; disableAutoMode turns auto mode off entirely1. Enterprise stays opt-in for now, but with the default planned “in the coming month,” the window for deferring the question is short1.
Recent weeks have brought a steady run of announcements about the balance between agent autonomy and control, from OpenAI pausing some internal work over a next-generation model’s cyber capabilities to Claude Code sessions gaining the ability to message each other. What distinguishes this one is that Anthropic used its own usage data to question the premise that a human approving each step is the safer arrangement. Whatever tooling you use, it is worth measuring whether your approval design is actually doing anything.
Anthropic itself writes that while it believes auto mode reduces risk for most users, it relies on classification systems and therefore does not eliminate risk, and that for high-stakes changes to production infrastructure it still recommends reviewing Claude’s actions yourself1. Configuration details are in the auto mode documentation.
Sources
- Auto mode is now the default in Claude Code for Pro, Max, and Team plans - Anthropic official blog (August 7, 2026)
- Running auto mode in production - Anthropic official blog (August 7, 2026)