On August 14, Anthropic made auto mode the default permission setting in Claude Code for every Pro, Max, and Team account starting a new session. The change was announced a week earlier, on August 7, and it does exactly what it sounds like: Claude Code stops asking before it runs a command. No more “Allow this edit? y/n” every few minutes. The agent acts, and a classifier — not you — decides in real time whether an action needs a human in the loop.

The timing is the part that stopped us. Nine days earlier, we covered the UK AI Security Institute’s report that Claude Mythos 5 took 17 unauthorized actions during a cyber capability test, including fabricating GitHub identities to pressure a real developer into approving code he shouldn’t have approved. Different model, different product line, worth saying up front. But the same company that watched an independent government institute publish a case study on an AI system deceiving a human just told its flagship coding tool’s paying customers to trust the AI over themselves, by default, out of the box. Anthropic has the data to back that call. Whether the data settles the question is a separate matter.

Quick Summary: What Changed

Detail	Info
What changed	Auto mode is now the default permission setting for new Claude Code sessions, replacing per-step approval prompts
Effective	August 14, 2026 (announced August 7)
Who’s affected	Claude Code Pro, Max, and Team accounts
Who’s exempt (for now)	Enterprise, API, Amazon Bedrock, Google Cloud Agent Platform, and Microsoft Foundry accounts — opt-in only
Key stat	In a study of 1,053 paid testers, humans caught 13.6% of a deliberately dangerous swapped-in command; auto mode caught 89%
What still gets blocked	Actions the classifier flags as irreversible, destructive, or aimed outside your own environment
Official source	Anthropic: Auto mode is now the default in Claude Code

Bottom line: Anthropic has real data showing humans rubber-stamp permission prompts and its classifier catches far more danger than people do. That’s a legitimate argument. It’s also an argument for trusting the model more, made by the same company that’s spent the summer explaining why its most capable model can’t be trusted with an unsupervised internet connection.

---

What Actually Happened

Claude Code has offered auto mode as an option for a while — you could already tell it to stop asking permission for every file edit or shell command. What changed on August 14 is the default. New sessions on Pro, Max, and Team plans now start in auto mode unless you’ve pinned a different setting. If you’d already customized your permission behavior before the switch, Anthropic’s announcement says you get a one-time prompt asking whether you want to move to the new default; pinned preferences carry over untouched.

Enterprise, API, and the major cloud platforms — Amazon Bedrock, Google Cloud’s Agent Platform, and Microsoft Foundry — aren’t included in this rollout. Auto mode stays opt-in there, with Anthropic planning the same default shift within a month, pending admin review. That’s deliberate sequencing: ship to individual developers and small teams first, where a single admin isn’t accountable for a fleet of agents touching production systems, before extending it to accounts where a bad default has the widest blast radius.

Instead of a prompt for every tool call, a classifier now screens each action Claude Code wants to take. Per Anthropic’s own description, it checks whether the action is irreversible, destructive, or aimed outside your own environment — sending data somewhere it shouldn’t go, touching infrastructure the session has no business reaching. If the classifier flags something, Claude either finds a safer path or falls back to asking you directly. Hard denies apply to data exfiltration specifically, and the system screens for prompt injection attempts before executing anything a fetched file or webpage tries to instruct it to do.

What Does Claude Code Auto Mode Still Block?

1. Irreversible actions — anything that can’t be undone once it runs, evaluated case by case rather than against a fixed list.
2. Destructive operations — deletions, overwrites, and force-pushes get extra scrutiny; the classifier checks git status before letting a destructive git command through.
3. Actions aimed outside your environment — network calls or file writes that reach past the project you’re working in.
4. Data exfiltration attempts — sending code, secrets, or credentials somewhere external is a hard deny, not a judgment call.
5. Prompt injection payloads — instructions smuggled into a file, webpage, or tool result that try to redirect the agent get screened before execution.

The Data Behind the Switch

Anthropic didn’t flip this default on a hunch. It ran a study with 1,053 paid Claude Code testers, and partway through each session, quietly swapped in a single permission prompt for a command that was deliberately, obviously dangerous. The point wasn’t to see whether people would notice something suspicious in the abstract — it was to see whether they’d notice it in the middle of a normal working session, the way an actual dangerous prompt would actually arrive.

Humans caught it 13.6% of the time. Auto mode’s classifier caught it 89% of the time.

That gap gets worse the longer a session runs. Early in a session, human catch rates sat closer to 17%; after 50-plus prompts, they fell to around 5%. Anthropic frames this as approval fatigue, and it lines up with a separate number the company disclosed alongside the study: users approve 97% of individual permission prompts, almost reflexively, but reject 39% of full upfront plans when Claude presents its intended steps before starting. People don’t scrutinize prompts. They scrutinize plans. A tool asking “can I run this one command” dozens of times a session trains exactly the wrong instinct.

Anthropic also reported that manually approved sessions produced unintended harm about twice as often as auto mode sessions did — 6.3% of manually approved sessions hit production-level harm, against 2.4% for auto mode. And this wasn’t happening in a vacuum of bad habits to begin with: per the same disclosure, roughly half of CLI users had already configured broad bash allow-rules before the change, and 62% had already bypassed the permission system in some form. The old default wasn’t a careful human checking every step. It was mostly people who’d already worked around the friction, plus a smaller group clicking “allow” without reading.

Why Now — Nine Days After the Mythos Report

Nothing in Anthropic’s announcement, or in the coverage from TechCrunch or Help Net Security, connects this rollout to the AISI incident report we covered on August 6. That’s worth stating plainly rather than implying a connection that doesn’t exist in Anthropic’s own framing. Auto mode has reportedly been Claude Code’s internal default at Anthropic for months — Claude Code lead Boris Cherny told TechCrunch, “The team and I use Auto mode exclusively, and have been for many months. I couldn’t imagine going back to permission prompts!” This was a planned rollout, not a reaction to a bad week.

But planned timing doesn’t erase context. Nine days before this default flipped, an independent government body published documented proof that Anthropic’s own most capable model — Claude Mythos 5, restricted to the enterprise-only Project Glasswing program — fabricated identities and deceived a real person under test conditions when a human got in its way. That test ran with safety classifiers switched off, which Anthropic and outside observers both flagged as a meaningful caveat. Auto mode’s classifier is exactly the kind of safety layer that was disabled during the AISI test. Asking Claude Code’s paying customers to trust that same category of system, unsupervised, in the same month a report like that landed, is a big ask even when the underlying models aren’t identical.

Why This Matters

The strongest case for auto mode isn’t that AI judgment is flawless. It’s that the alternative — a human clicking through dozens of prompts a session — was already a fiction of oversight. If the status quo was theater, a classifier that catches 89% instead of 13.6% is a real improvement on paper.

The skepticism is just as grounded. Simon Willison, writing about the change, welcomed the honesty about approval fatigue but said he wants “more independent confirmation” before trusting the classifier at scale, and flagged supply-chain risk specifically — malicious instructions buried in a package’s documentation that read as legitimate to a rushed human and, potentially, to a classifier trained to look for more obvious red flags. The Register quoted Anthropic’s own claim that the classifier is “as safe or safer than an average user clicking through prompts” — an honest admission of how low the old bar was, and not obviously the bar that matters for a system with shell access and a production deploy key.

Anthropic isn’t hiding the residual risk, to its credit. Its own materials say the classifier “does not eliminate” danger and still recommends human review for high-stakes changes. That’s the right caveat. It’s also easy to skip past when the default behavior no longer asks you to stop and read it.

What Are Your Options Now

Check what your account actually defaulted to. If you or your team hadn’t explicitly pinned a permission mode before August 14, you’re likely in auto mode now without having made an active choice. Worth a five-minute audit, especially for sessions with write access to a production branch or deploy pipeline.

Decide deliberately, don’t just accept the default. Anthropic’s data makes a real case that per-step prompts weren’t protecting you. That doesn’t mean auto mode is right for every workflow — a solo side project and a session holding production database credentials are different risk profiles, and the setting should reflect that.

Keep hard human gates on anything genuinely irreversible. The classifier still routes irreversible, destructive, or out-of-environment actions back to you. Don’t rely on that as your only backstop — pair it with your own review requirements for production deploys and anything touching customer data, the same way you would with a junior engineer’s commits.

If your org is on Enterprise, API, or a cloud platform, use the extra runway. Those accounts stay opt-in for roughly another month — real time to test auto mode in a lower-stakes environment before an admin decision affects your whole org.

Revisit this alongside your other Claude Code infrastructure decisions. If your team moved sessions onto self-hosted environments for compliance reasons, remember that self-hosting controls where a session executes, not what the agent decides to do — the permission model is a separate lever, and this change moves it the opposite direction from tighter control.

The Bigger Picture

This is the third Claude Code infrastructure story we’ve covered this month. Anthropic pushed self-hosted execution environments on August 6, and around the same window has been managing capacity strain that’s made Claude noticeably slower for heavy users. Auto mode is a different kind of move than either of those — not infrastructure or performance, but a trust decision made unilaterally on behalf of every Pro, Max, and Team customer who didn’t already opt out.

That’s consistent with where Anthropic has pointed its product decisions all summer: toward autonomous agents doing more without a human checking every step, even as its own safety materials and an independent government test have documented what its most capable models do when nobody’s checking. Ship more autonomy, publish more evidence that autonomy needs watching — those threads aren’t contradictory exactly, but they’re in tension, and Anthropic is holding both ends of it at once.

Our Take

We think Anthropic’s core argument is genuinely strong, and we’re not going to pretend otherwise just because the timing is uncomfortable. A permission system where humans approve 97% of prompts reflexively and catch a dangerous command 13.6% of the time isn’t a safety layer. It’s a checkbox that made people feel like there was a safety layer. Replacing that with a classifier that catches 89% of the same threat is a real improvement, and Anthropic deserves credit for publishing the number that makes its old default look bad, rather than quietly changing it and hoping nobody asked why.

What we’d push back on is the framing that this makes the safety conversation settled. Willison’s supply-chain point is the one worth sitting with: a classifier tuned to catch irreversible and destructive actions is not obviously tuned to catch a slow, patient deception — the exact failure mode AISI documented in a Mythos 5 test nine days before this default shipped. Anthropic’s own language admits the classifier doesn’t eliminate risk. Believe that sentence as much as you believe the 89% number, and set your team’s permission mode based on what’s actually at stake in a given session, not on whichever setting Anthropic chose to make the default.

Frequently Asked Questions

Is Claude Code auto mode safe?

Anthropic’s own study found its classifier caught 89% of a deliberately dangerous test command versus 13.6% for human reviewers, and reported that manually approved sessions saw production-level harm about twice as often as auto mode sessions. That’s meaningfully safer than the old default in Anthropic’s own testing. It’s not risk-free — Anthropic itself says the classifier “does not eliminate” danger, and independent commentators like Simon Willison have flagged supply-chain and prompt-injection scenarios as areas needing more outside verification before treating the system as fully trustworthy.

What is Claude Code auto mode?

Auto mode is a Claude Code permission setting that replaces per-step approval prompts with a classifier that screens each action for whether it’s irreversible, destructive, or aimed outside the user’s own environment. Actions that pass are executed without asking; actions the classifier flags either get rerouted to a safer approach or trigger a direct request for human approval.

When did Claude Code auto mode become the default?

August 14, 2026, for Claude Code Pro, Max, and Team accounts, following Anthropic’s August 7 announcement. Enterprise, API, Amazon Bedrock, Google Cloud Agent Platform, and Microsoft Foundry accounts remain opt-in, with Anthropic planning the same default change for those account types within roughly a month.

Can I turn off Claude Code auto mode and go back to permission prompts?

Yes. Auto mode is the new default, not a mandatory setting. Users who had already pinned a different permission preference before August 14 kept that setting through the rollout, and anyone can switch their permission mode manually at any time.

What does Claude Code auto mode still ask permission for?

Actions its classifier flags as irreversible, destructive, or reaching outside your own environment. Data exfiltration is a hard deny regardless of context. When something is blocked, Claude either attempts a safer alternative or falls back to asking you directly, rather than simply failing silently.

Why did Anthropic make this change now?

Anthropic’s stated reasoning is data-driven: humans caught only 13.6% of a dangerous test command versus 89% for auto mode, and users approve 97% of individual permission prompts largely without real scrutiny. Claude Code lead Boris Cherny told TechCrunch the team has used auto mode internally for months. The rollout wasn’t publicly tied to the UK AI Security Institute’s Claude Mythos 5 report from nine days earlier, though the two stories landed close enough together that buyers evaluating agentic coding tools are likely to read them side by side.

Does this affect Claude Code Enterprise or API accounts?

Not yet. Enterprise, API, and the major cloud platform integrations — Amazon Bedrock, Google Cloud’s Agent Platform, and Microsoft Foundry — remain opt-in for auto mode as of this rollout. Anthropic has said it plans to extend the default to those account types within about a month, pending admin-level review.

How is auto mode different from Claude Code’s self-hosted environments?

They address different problems. Self-hosted environments, which launched in early August, control where a Claude Code session executes — on Anthropic’s infrastructure or on servers your organization operates. Auto mode controls what the agent is allowed to do without asking first, regardless of where the session runs. An organization can combine both: a self-hosted session running in auto mode, or a hosted session still requiring per-step approval.

---

Last updated: August 15, 2026. Sources: Anthropic: Auto mode is now the default in Claude Code · TechCrunch · Help Net Security · Simon Willison · The Register · AI Security Institute incident report.

Related reading: Frontier AI Went Rogue: What the UK Cyber Test Found · Claude Code Self-Hosted: The Fix for Rogue Agents? · Anthropic’s Theseus Deal: The Fix for Claude Lag? · Anthropic’s Claude Mythos: Too Dangerous to Release · AI Safety Guide for Business