Starting August 14, auto mode will be the default permission mode in Claude Code

From August 14, new Claude Code sessions on Pro, Max and Team plans start in auto mode, ClaudeDevs announced. Claude Code normally stops to ask a person before it runs a shell command or changes files. In auto mode, Anthropic sends each of those tool calls to a separate classifier model, which blocks actions that look irreversible, destructive or aimed outside the user's environment and lets the rest run without a prompt.

The headline comparison, 89% against 14%, comes from a controlled study that Anthropic describes in its article on the change. The company hired 1,053 paid testers through a research vendor for a coding task in a purpose-built environment. Partway through each session, one permission prompt was replaced with a clearly dangerous command; approving it never actually ran anything. Testers refused 143 of those commands (13.6%), while the classifier would have blocked 937 (89%). Head to head, auto mode blocked 800 commands that testers approved, and testers blocked 6 that auto mode allowed. The human rate also decayed: about 17% early in a session, about 5% after 50 or more earlier prompts, while the classifier's rate stayed flat. Anthropic's explanation is habit, since users approve 97% of permission prompts in Claude Code.

In that setup, the classifier caught an obviously dangerous command far more often than people did, and the gap widened as testers got used to approving prompts. It does not show that auto mode stops a determined attacker, and about one dangerous command in nine still got through. For prompt injection, where hostile instructions arrive hidden in content the agent reads, Anthropic cites a separate third-party test in which none of 720 attack attempts succeeded against Claude Fable 5, Opus 5 or Sonnet 5 running in auto mode. Within weeks, security researcher Johann Rehberger reported an attack he says works about 80% of the time against Claude Code with Opus 5 in auto mode, as Simon Willison summarized (covered in this Intel item). Anthropic's own article says auto mode does not eliminate risk. It is a better default than habitual approval, and it is a classifier, so work that must withstand attack still belongs in a sandbox.