Anthropic announced that Claude Code's auto mode will become the default setting for new sessions on Pro, Max, and Team accounts beginning August 14. This update replaces the manual approval prompts that developers have long clicked through with little scrutiny. The change hands routine permission decisions to a proprietary classifier that evaluates each tool call and intervenes only when an action is deemed irreversible, destructive, or directed outside the user's environment.
The shift addresses confirmation fatigue, as users approve 97 percent of permission prompts in Claude Code. Internal telemetry shows that by June, 62 percent of users had tried bypassing permissions or selected "don't ask again" for Bash commands, and 49.5 percent of active CLI users had created a Bash allow rule.
In a study with 1,053 paid testers, Anthropic planted a clearly dangerous command among routine permission prompts. Auto mode blocked 89 percent of those commands while human testers refused only 13.6 percent. Human vigilance dropped further as sessions lengthened, falling to roughly 5 percent after 50 or more prompts. Claude Code head Boris Cherny noted that the team has used auto mode exclusively for many months and could not imagine returning to permission prompts.
Residual Risks and Independent Testing
The 89 percent block rate leaves an 11 percent miss rate, with 116 of the 1,053 planted commands passing through undetected. A separate synthetic adversarial evaluation conducted with Apollo Research lowered the miss rate to 7 percent after classifier hardening, although Anthropic noted that this figure comes from a deliberately hostile dataset and is not a real-traffic measurement.
Anthropic commissioned Trajectory Labs to run 720 indirect prompt injection attacks against Claude Fable 5, Opus 5, and Sonnet 5 in auto mode. None succeeded. Developer and researcher Simon Willison, however, cautioned that a zero-success rate on curated scenarios does not guarantee resilience against supply-chain-style attacks, such as malicious third-party packages that instruct an agent to fetch and execute additional files.
Guardrails and Scope
When auto mode blocks an action, Claude attempts a safer alternative or asks for explicit authorization. Three consecutive denials or 20 total in an interactive session revert the tool to manual approvals; headless runs terminate instead. Teams can further tighten controls with explicit ask rules for operations like pushes or pull requests, and deny rules that cannot be overridden.
Anthropic confirmed it will not charge Pro, Max, and Team users for the small token overhead the classifier adds per tool call. Enterprise, API, and platform deployments on Amazon Web Services, Google Cloud, and Microsoft Foundry remain opt-in while a broader rollout is prepared.