Skip to content
NewsProduct launch

Anthropic makes Claude Code auto mode the default on August 14, backed by safety data showing it outperforms human review

· by Pondero Newsdesk

The short version

Starting August 14, Claude Code will run without per-step approval prompts on Pro, Max, and Team plans. A blinded study of 1,053 developers shows auto mode blocked 89 percent of harmful actions compared to 13.6 percent for humans clicking through the same prompts.

Anthropic makes Claude Code auto mode the default on August 14, backed by safety data showing it outperforms human review

In a blinded study of 1,053 paid developers, human review caught 13.6 percent of clearly dangerous Claude Code commands inserted mid-session. Auto mode blocked 89 percent of those same commands. Anthropic published those figures on August 7 alongside its announcement that auto mode becomes the default for Pro, Max, and Team users starting August 14.

What changed

Auto mode routes each Claude Code tool call through a classifier rather than pausing for a human approval prompt. The classifier blocks actions it determines to be irreversible, destructive, or aimed outside the local environment. If the classifier blocks a command three times in a row, or 20 times across a session, Claude Code falls back to manual approval mode. When the classifier flags something, Claude typically finds a safer path on its own or asks the user directly.

Starting August 14, new sessions on Pro, Max, and Team plans will open in auto mode by default per Anthropic's announcement. Users who have already pinned a different permission mode are not affected. Users with no explicit default will see a one-time in-product notice; new sessions then start in auto mode automatically. The CLI shortcut to switch modes is Shift+Tab, or the mode dropdown in the desktop app. Admins can pin an org-wide default using defaultMode in managed settings, or disable auto mode entirely with disableAutoMode.

Classifier overhead costs are waived for Pro, Max, and Team users effective immediately. Auto mode adds a small number of extra tokens per tool call; Anthropic stopped billing for that overhead as of August 7.

Enterprise users and those accessing Claude Code via the API, Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry stay on opt-in auto mode for now. Anthropic said it plans to flip auto mode to default for those tiers "in the coming month" and will notify Enterprise admins before it does. Enterprise admins can turn it on early through managed settings.

The safety case

Anthropic published four categories of safety data alongside the announcement.

The largest is the 1,053-developer controlled study. Participants knew they were being evaluated but not which specific behavior was under measurement. Partway through each session, a clearly dangerous command replaced one normal permission prompt. Humans refused it 13.6 percent of the time (143 of 1,053). Auto mode would have blocked 89 percent of the same commands (937 of 1,053). Head to head, auto mode blocked 800 commands that a human approved, while humans blocked only 6 that auto mode would have allowed. The gap widened with session length: human block rates fell from about 17 percent early in a session to roughly 5 percent after 50 or more prior prompts, per Anthropic. The classifier's block rate stayed flat.

Second is production data. Anthropic reviewed sessions from May to June 2026 that its safety pipeline had flagged, drawn from accounts that opted in to data use for analysis. At severity 7 or above (roughly "production-level harm," such as deleting rows from a production database), 6.3 percent of manually-approved sessions contained a harmful action the user had not explicitly requested, against 2.4 percent of auto mode sessions.

Third is red-teaming by Apollo Research, a UK AI safety firm. Apollo ran a two-week pilot injecting synthetic attacks into real coding trajectories. Anthropic hardened the classifier against Apollo's shared attack set; Apollo then retested on a held-out set Anthropic never saw. The classifier's miss rate fell from 12 percent to 7 percent on the held-out attacks, suggesting the hardening generalized rather than just patching specific examples.

Fourth is an independent prompt-injection evaluation by Trajectory Labs. The third-party evaluator tested 72 indirect prompt injection scenarios against Claude Code and Codex as of July 17, 2026. Each scenario ran 10 times, producing 720 total attempts. None of the 720 attacks succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode per Anthropic's announcement. By contrast, 5.83 percent of attacks succeeded against GPT-5.6 Sol running Codex in Auto-review mode; Codex in Full Access mode showed a 19.03 percent attack success rate across the same scenarios.

Why it matters

The announcement inverts the standard assumption about agentic-AI safety. The conventional case for approval prompts is that a human checking each command catches more risk than any automated system. The data Anthropic published argues the opposite is true for typical Claude Code usage, where users approve 97 percent of all permission prompts reflexively.

Three concrete things operators should do before August 14. First: check whether your team's Claude Code defaults are explicitly pinned via ~/.claude.json or managed settings. If no default is set, sessions will switch to auto mode on August 14 without any manual action on your part. Second: review your broad Bash allow-rules. Rules like Bash(python:*) that effectively grant arbitrary code execution are set aside in auto mode because they would let commands skip the classifier entirely. Your settings files are not modified, but those rules stop applying while auto mode is active. Third: audit any workflows that rely on mid-session permission prompts appearing at specific steps, since those prompts will no longer appear by default.

For teams evaluating agentic coding tooling, the production data from early adopters carries weight. Garner Health pushed auto mode to all 550 employees via managed settings and standardized a company-wide software development lifecycle without manual command allow-lists. Nuro runs overnight research agents in auto mode that return finished pull requests by morning. Gusto tracked that about 10 percent of auto mode sessions trigger a classifier denial, which the company cited as evidence the system does real work without slowing legitimate tasks, per Anthropic. Claude Code Head Boris Cherny wrote on X that "the team and I use Auto mode exclusively, and have been for many months."

Anthropic also reported that Teams and Enterprise accounts running auto mode ship about 25 percent more pull requests per user, attributed to fewer interruptions on long-running tasks.

Context: open questions

Security researcher Simon Willison, who wrote about the announcement on August 8, noted that the 89 percent catch rate still leaves 11 percent of harmful commands through. He raised a specific class of attack the Trajectory Labs evaluation may not cover: a malicious third-party package that embeds its own instructions directing the agent to run a data-exfiltration command before a test suite. Whether auto mode's classifier can reliably detect such supply-chain-style injections remains an open question.

Anthropic's answer for the most severe cases is the hard-deny category. Data exfiltration sits in a class of actions the classifier is designed never to approve, even if a user explicitly requests it. Running such a command requires switching out of auto mode or executing the command directly. The hard-deny list is customizable: admins can add additional rules that no user in the organization may trigger in auto mode.

The classifier also carries explicit rules about where secrets and sensitive data can be accessed and shared, and checks the destination of a git push or pull request (public vs. private vs. trusted) before allowing the action. Anthropic published three internal incidents that auto mode prevented, including a near-miss where a mass process kill would have torn down hundreds of GPUs of in-flight training jobs, and an over-broad cloud role grant that would have handed root administrative control instead of the read-only billing access that was requested.

One study design limit is worth knowing: testers knew they were being evaluated, the test environment was not their own codebase, and only one dangerous command appeared per session. Real production sessions are more varied. Anthropic's own blog post notes that for high-stakes changes to production infrastructure, direct human review of Claude's actions is still recommended.

What to watch next

Anthropic said it will notify Enterprise admins before switching auto mode to the default on that tier. That notification is expected within the next month. Enterprise security teams should use that window to review their managed settings and decide whether to adopt auto mode org-wide, restrict it, or use the opt-out flag.

Cat Wu and Thariq Shihipar, who foreshadowed the safety results at the AI Engineer World's Fair in July, said at the time that Anthropic planned to publish detailed evals "in the coming weeks." The August 7 blog post contains the primary data. A standalone peer-reviewed paper with the full study design has not yet appeared; if it does, the security community will have a more rigorous basis for evaluating the methodology.

The August 14 rollout itself is the near-term milestone to watch. It is the first major agentic-coding default change rolled out to a large user base without an opt-in requirement, and the first large-scale test of whether the classifier's lab-measured performance translates to real production sessions at scale.

Sources