Anthropic is flipping the default permission setting in Claude Code, betting that an AI classifier can catch dangerous commands more reliably than the humans who currently click through them.
Starting August 14, 2026, new Claude Code sessions on Pro, Max, and Team plans will launch in “auto mode” by default, replacing the manual approval prompts that have governed the coding agent’s actions until now.
The change addresses what Anthropic’s own telemetry reveals as a broken review model. Users approve 97% of permission prompts in Claude Code, a rate the company says reflects reflexive clicking rather than genuine scrutiny.
Claude Code Makes Auto Mode Default
Compounding the problem, 49.5% of active CLI users have manually created Bash allow-rules, and 62% have used bypassPermissions or “don’t ask again” settings on shell commands, with a quarter of interactive sessions now starting directly in bypass mode.
Auto mode replaces prompt-driven review with a classifier that evaluates each tool call for irreversible, destructive, or externally-directed actions.
When it blocks something, Claude typically finds a safer path or escalates to the user; if it hits three consecutive blocks or twenty in a session, it falls back to manual approvals.
Permission rules still fire before the classifier except for overly broad allow-rules like Bash(python:*) that would let commands skip the classifier entirely.
In a controlled study with 1,053 paid testers, researchers swapped a routine permission prompt for a clearly dangerous command mid-session. Human testers caught it just 13.6% of the time (143 out of 1,053), while auto mode blocked 89% (937 out of 1,053).
The gap widened as sessions grew longer: human detection dropped from roughly 17% early in a session to about 5% after 50-plus prior prompts, while the classifier’s block rate stayed flat.
Real-world session analysis from May–June 2026 showed that manually approved sessions contained serious unintended harm more than twice as often as auto-mode sessions, with a 6.3% versus 2.4% rate of production-level severity incidents.
A two-week adversarial engagement with Apollo Research reduced the classifier’s overall miss rate from 12% to 7% after a find-fix-verify hardening cycle.
Anthropic stated that third-party evaluation by Trajectory Labs tested 72 indirect prompt injection scenarios across Claude Code and OpenAI’s Codex.
None of 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 in auto mode, compared to a 5.83% success rate against GPT-5.6 Sol in Codex’s Auto-review mode and 19.03% in Full Access mode.
New safeguards accompanying the rollout include hard denies for data exfiltration, rules distinguishing where secrets can be shared, git-status checks before destructive commands like git reset --hard, and prompt-injection screening on external content.
Internally, auto mode reportedly prevented an off-network data leak, a mass pod kill affecting in-flight GPU training jobs, and an attempt to provision an overprivileged cloud role.
Auto mode remains opt-in for Claude Enterprise, the Claude API, and cloud partner platforms (AWS, Google Cloud, Microsoft Foundry) for now, with a default switch planned within the coming month.
Anthropic still recommends manual review for high-stakes production infrastructure changes, noting that the classifier reduces, but doesn’t eliminate, risk.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
