Anthropic Makes Claude Code Auto Mode Default, Pushing AI Coding Agents Toward More Autonomy

For most of Claude Code's existence, the arrangement was simple: the AI proposes, the human disposes. Every file write and every shell command paused for a click of approval. Last week, Anthropic declared that arrangement largely obsolete. Beginning August 14, new Claude Code sessions on Pro, Max, and Team plans will start in auto mode by default, letting the coding agent approve its own routine actions while a purpose-built classifier watches for the dangerous ones.

It is one of the clearest signals yet of where AI-assisted software development is heading: away from turn-by-turn supervision and toward agents that run for hours, with humans reviewing the results rather than the steps.

The awkward truth about the approve button

Anthropic's case for the change is blunt: manual review, in practice, barely happens. The company's own data shows developers wave through 97 percent of individual permission prompts. The contrast is telling: when Claude presents an entire plan for sign-off, users reject it 39 percent of the time, but when it asks about a single command, the rejection rate collapses to 3 percent.

Dozens or hundreds of micro-decisions a day, arriving mid-flow, had turned the safety ritual into white noise.

Usage patterns tell the same story. As of June, nearly half of active command-line users had written their own rules to silence prompts for shell commands, with about 5 percent allowing any command outright. Some 62 percent had at some point reached for the bypass-permissions escape hatch or clicked "don't ask again," and a quarter of interactive sessions started with permission checks switched off entirely. Many developers, in other words, had voted with their config files long before Anthropic made it official.

How auto mode works

Auto mode, first launched as a research preview in March, was pitched as a middle path between Claude Code's deliberately conservative defaults and the risky practice of skipping permissions altogether. Rather than interrupting for sign-off, it routes every tool call through a classifier targeted at blocking actions that are "irreversible, destructive, or aimed outside your environment," as Anthropic puts it. When something gets blocked, Claude usually reroutes to a safer approach or checks in with the user directly. And if it keeps hitting walls, three blocks in a row or twenty across a session, the system concedes defeat and falls back to old-fashioned manual approvals.

Anthropic has spent recent months hardening the system ahead of the switch. Data exfiltration (sending code or secrets somewhere external) now sits in a hard-deny category the classifier is designed never to approve, no matter how the request is phrased; running such an action requires leaving auto mode or typing the command yourself. The classifier also checks whether the destination of a git push or pull request is public, private, or trusted before letting it through. Before a destructive command like a hard reset, it inspects the repository's git status so it knows what uncommitted work is at stake. Content Claude pulls from the web gets screened for prompt-injection attempts as well, and so do file contents and other tool outputs.

The numbers behind Anthropic's confidence

The most striking evidence comes from a controlled experiment with 1,053 paid professional testers. Working in a sandboxed environment and unaware of what was being measured, each participant had a single ordinary permission prompt swapped mid-session for a clearly dangerous command (approving it never actually executed anything). The humans caught it just 13.6 percent of the time. Auto mode caught 89 percent. Head to head, the classifier blocked 800 commands that humans approved, while humans caught only six that the classifier would have let through. Worse, human vigilance decayed with fatigue — from roughly 17 percent early in a session to about 5 percent after fifty prompts — while the classifier's block rate stayed flat no matter how long the session ran.

Production data points the same way. Reviewing flagged sessions from May and June, drawn only from accounts that opted in to data analysis, Anthropic found that serious harm the user never asked for appeared more than twice as often under manual approvals as under auto mode: 6.3 percent of flagged manual sessions versus 2.4 percent, at production-level severity.

Outside auditors were brought in, too. Apollo Research, a UK-based AI safety firm, spent two weeks injecting synthetic attacks into real coding workflows; after Anthropic hardened the classifier in response, its miss rate on a held-out attack set Apollo never shared fell from 12 percent to 7 percent. And in an independent prompt-injection evaluation by Trajectory Labs, which ran 72 attack scenarios ten times each, none of the 720 attempts succeeded against Anthropic's latest models running auto mode, while 5.83 percent got through OpenAI's GPT-5.6 Sol in Codex's comparable auto-review mode. Anthropic is upfront about the caveats. The attacks are adversarial by design, and the tests used a neutral third-party browser integration rather than either company's full safeguard stack. OpenAI has since shipped an update that could change its numbers.

The company even volunteered three saves from inside its own walls, where auto mode is already the universal default. The classifier stopped Claude from publishing an internal report to a public code-sharing site after an upload to a company drive failed. It flagged a mass process-kill across roughly two thousand pods that would have torn down hundreds of GPUs' worth of in-flight training jobs. And when Claude was asked to provision read-only billing access, it caught the model reaching for a cloud role with full administrator control.

Autonomy as a product strategy

Safety is only half the pitch. The other half is throughput.

Anthropic says Team and Enterprise customers running auto mode ship about 25 percent more pull requests, and the mode makes it practical to leave long-horizon models like Claude Opus 5 grinding away on big tasks unattended. At autonomous-delivery company Nuro, one engineer described kicking off an agent at 10 p.m. and waking to three finished pull requests by morning. Adobe runs auto mode inside the agentic loop that builds and verifies pricing pages across more than 90 countries. Gusto adopted it to cure the permission fatigue that was pushing its engineers toward bypassing checks entirely. About one in ten of its sessions since mid-May has included a classifier denial, evidence the guardrail is doing real work. Garner Health flipped it on for all 550 employees via managed settings.

The internal conviction runs deep. "Broadly within Anthropic, almost every single person uses auto mode," Claude Code product lead Cat Wu said at the AI Engineer World's Fair earlier this summer.

As a sweetener, Anthropic has also stopped charging users on the affected plans for the small number of extra tokens the classifier consumes on each tool call.

What changes on - and what doesn't

The new default applies to fresh sessions on those three plans. Anyone who has pinned a different default keeps it untouched; users who previously set another mode may see a one-time prompt asking whether they want to switch. Enterprise customers and Claude API users remain opt-in for now, as do deployments through Amazon Bedrock, Google Cloud's agent platform, Microsoft Foundry, and the Claude Platform on AWS. Anthropic plans to flip those defaults in the coming month after giving administrators notice. Switching modes takes a Shift+Tab in the CLI or a dropdown on the desktop app, and organizations can pin an org-wide default through managed settings, or disable auto mode entirely.

Anthropic is also careful to note the limits of its own argument: a classifier reduces risk rather than eliminating it. The company still recommends personally reviewing any high-stakes change to production infrastructure.