We recently made auto mode the default in Claude Code, which means you no longer

Anthropic has made auto mode the default permission setting in Claude Code, its coding agent, so the agent no longer stops to ask before each command, web fetch or file edit. In a video posted on August 10 by ClaudeDevs, the company's developer account, Anthropic says its research found that 97% of these permission prompts get approved, and that answering them on long, multi-step tasks leads to approval fatigue. Auto mode keeps a check on risky actions but hands it to a classifier, a separate check that sees the user's messages and the actions Claude proposes, but not Claude's reasoning, its replies to the user or the output of its tools. Anthropic compares letting the agent approve its own actions to writing, reviewing and merging your own pull request. Keeping Claude's explanations out of view is meant to stop the agent's own framing from swaying the decision.

The classifier looks for one kind of failure: Claude reaching past what the user asked for toward something irreversible or destructive, such as deleting remote branches when the user only asked it to tidy up locally. Not every action reaches it. The user's deny, ask and allow rules apply first, then a tier check lets read-only or recoverable work, like searching the codebase or editing files in the project, run without review, while shell commands, web fetches and anything reaching outside the environment go to the classifier. When it denies an action, Claude usually looks for a safer route, for example pushing to a new branch after a force push is refused. If denials keep coming, auto mode pauses and asks the user to approve the action. A second layer handles prompt injection, meaning hidden instructions in a web page or file that try to pull the agent away from the user's request. A server-side probe scans every tool result before it enters Claude's context and attaches a warning to anything suspicious, and the classifier then checks whether Claude's next action still matches what the user asked for, so an attack has to get past both.

How much auto mode lets through depends on a trust boundary the user configures. By default the classifier treats only the working directory and its git remote as internal, so a company's own infrastructure looks external. Administrators can describe their environment in plain English, such as the GitHub organization, cloud buckets and internal services, in managed settings that every developer inherits, and developers can add their own entries on top. Allow, soft deny and hard deny entries are guidance the classifier weighs, not fixed rules. For hard limits, Anthropic points to deny rules, which block matching tool calls, and ask rules, which force a prompt even in auto mode. Its advice is to start narrow, watch what gets denied, widen from there, and review high-stakes actions such as changes to production infrastructure yourself.

The evidence that this works comes from Anthropic's own testing. The video says that with the probe and auto mode enabled, the success rate of prompt-injection attacks in its evaluations dropped to zero, without describing those attacks. Anthropic's earlier engineering write-up on the design (earlier coverage) reported a 17% false-negative rate on real overeager actions, meaning dangerous actions of that kind the classifier let through, and said auto mode is not a drop-in replacement for careful human review on high-stakes infrastructure. Weeks after the video, prompt-injection researcher Johann Rehberger reported an attack on auto mode that he says works 80% of the time (Simon Willison's summary, covered here). Auto mode cuts interruptions and adds two automated checks, but it is a filter with measured misses, and the zero figure describes Anthropic's evaluations, not every attack a user might meet.