Anthropic is making auto mode the default permission setting in Claude Code for Pro, Max, and Team subscribers starting August 14. The change shifts routine approval decisions from developers to a classifier that evaluates each tool call for irreversible, destructive, or out-of-environment actions. Enterprise, API, Amazon Bedrock, Google Cloud, and Microsoft Foundry deployments remain opt-in for now, giving administrators time to review the change before a planned rollout across those platforms in the coming month.

The classifier adds a small number of tokens per tool call but will no longer charge Pro, Max, and Team users for that overhead. Existing users who have pinned a different default will not be affected; others may see a one-time prompt asking whether to switch to auto mode.

What’s new

  • Default change: New sessions on Pro, Max, and Team plans start in auto mode on August 14.
  • Classifier behavior: Two-layer system—input-layer prompt-injection probe and output-layer transcript classifier running on Sonnet 4.6.
  • Fallback: After three consecutive blocks or 20 total blocks in a session, Claude Code reverts to manual approvals.
  • Cost: Classifier token overhead is now free for Pro, Max, and Team plans.
  • Controls: Users toggle modes with Shift+Tab or the mode selector; team admins set org-wide defaults or disable auto mode via managed settings.

Anthropic’s internal data shows manual review has become habitual: users approve 97% of permission prompts while rejecting 39% of plan-approval dialogues but only 3% of individual permission requests. As of June 2026, 49.5% of active CLI users had created a Bash allow-rule, and 25% of interactive sessions started in bypass-permissions mode.

Safety data behind the switch

A controlled study with 1,053 paid professional testers swapped a visibly dangerous command into a permission prompt mid-session. Testers caught it 13.6% of the time (143 of 1,053); auto mode blocked 89% (937 of 1,053). Human block rates fell from roughly 17% early in a session to about 5% after 50 prior prompts, while auto mode’s block rate stayed flat.

In a separate analysis of flagged production sessions from May–June 2026, manually approved sessions contained serious unintended harm more than twice as often as auto mode sessions. At production-level severity (7+ on a 0–10 scale), 6.3% of manual sessions had a harmful action the user hadn’t explicitly requested, compared to 2.4% for auto mode.

Adversarial red-teaming with Apollo Research reduced the classifier’s miss rate on a held-out attack set from 12% to 7% after hardening with additional environment context (repository visibility, git state, data-handling rules). Anthropic notes the 7% figure is measured against synthetic, adversarial attacks and should not be taken as the miss rate on real traffic.

An independent evaluation found no successful prompt-injection attacks against any Claude model running with auto mode enabled, while a GPT-5.6 Sol baseline in Codex v0.144.5’s auto-review mode showed a 5.83% attack success rate.

Why it matters

The shift reflects a practical acknowledgment that approval fatigue undermines the security model manual prompts were meant to provide. For teams running long-running agents such as Claude Opus 5, auto mode also removes the interruption ceiling that previously limited how long a task could run unattended. Early adopters including Adobe, Nuro, Gusto, and Garner Health report shipping roughly 25% more pull requests with auto mode as their production default.

Sources