Anthropic makes auto mode the default in Claude Code
From August 14 the coding agent stops asking permission per action for Pro, Max and Team users, routing tool calls through a safety classifier instead.
Anthropic said on Friday that auto mode will become the default permission setting in Claude Code for Pro, Max and Team subscribers starting August 14, 2026. Instead of pausing for a human click before each shell command, file write or network call, the agent routes every tool call through a classifier trained to intercept actions that are irreversible, destructive, or that reach outside the user's own environment. The classifier's inference cost will no longer be billed to those plans.
The company framed the change as a safety improvement rather than a convenience one. In a controlled study of 1,053 paid testers, Anthropic reported that human reviewers rejected only 13.6 percent of dangerous commands presented to them, while auto mode blocked 89 percent — evidence, it argued, that click-through fatigue has made per-action approval close to decorative. Anthropic also said it ran 72 prompt-injection scenarios across 720 attempts against its current models in auto mode without a successful breach, and that internally the mode has stopped confidential uploads and killed roughly 2,000 processes that would have disrupted GPU training jobs. Users can still cycle modes with Shift+Tab, existing custom defaults are preserved, and enterprise administrators can pin an org-wide setting; for Enterprise and direct API customers the mode stays opt-in for now.
The rollout drew immediate scrutiny. Developer Simon Willison, who has tracked agent security throughout the year, wrote that auto mode is a more honest answer than expecting humans to keep approving actions they no longer read, but said the injection results need independent replication and remain untested against the harder case — a malicious third-party package that the agent has good reason to trust. He restated his standing prediction of a serious coding-agent security incident in 2026.
Why it matters
Claude Code is among the most widely deployed coding agents, and its permission prompt has functioned as the industry's default safety story: a human in the loop on every consequential action. Anthropic is now publishing data arguing that loop does not work, and shifting the guarantee from human judgment to a model-based classifier. If rivals follow, the operative safeguard for autonomous code execution becomes a piece of software that vendors, not users, control — and the burden shifts to independent researchers to verify that it holds.