TL;DR
Anthropic made auto mode the default for new Claude Code sessions on Pro, Max and Team plans on August 14. The mode lets an AI classifier approve routine actions and block suspected harmful ones, but Anthropic’s safety and productivity figures have not been independently verified.
Anthropic made auto mode the default for new Claude Code sessions on Pro, Max and Team plans on August 14, allowing its coding agent to carry out many actions without seeking approval at each step. The change could make long-running development tasks faster, while placing more responsibility on Anthropic’s automated safety classifier.
In auto mode, Claude Code reviews each proposed tool action through a separate classifier before execution. Anthropic says the system permits routine actions but blocks or escalates requests judged irreversible or destructive, directed at unrecognized infrastructure, or influenced by suspected prompt injection.
The change affects the starting permission mode; it does not remove user controls. Users can select another mode, while Team administrators can restrict access through managed settings. Auto mode also differs from Claude Code’s bypass-permissions option, which skips approval checks without the same classifier review.
Anthropic said it will no longer charge users for the small amount of classifier usage generated by each tool call. That removes one cost tied to the mode as Anthropic promotes it for longer, less interrupted coding sessions.
Anthropic Turns Auto Mode On by Default
New Claude Code sessions on Pro, Max and Team now begin with an AI classifier deciding which tool actions can proceed—and which require intervention. The promise is faster agentic coding; the unresolved question is how reliably the classifier handles real-world risk.
Harmful test actions blocked by auto mode in Anthropic’s study.
More pull requests among Team and Enterprise users of auto mode.
More execution, fewer interruptions
Auto mode changes the starting permission posture—not the availability of user controls. Claude Code can continue through routine actions while a separate classifier evaluates each proposed tool call.
Proceed automatically
File edits, commands and multi-step development work can continue without a confirmation prompt before every action.
Block or escalate
The classifier can intervene when an action appears destructive, irreversible, directed at unfamiliar infrastructure or shaped by prompt injection.
Remain configurable
Users can choose another permission mode, while Team administrators can restrict or disable auto mode through managed settings.
Default does not mean unrestricted
Auto mode sits between repeated manual approval and bypassing permission checks entirely. Its defining feature is classifier review before execution.
Ask frequently
Human review: frequent
Classifier gate: not the primary control
Trade-off: more interruption
Auto mode
Human review: selective
Classifier gate: every proposed tool action
Trade-off: automated judgment
Skip approval checks
Human review: minimal
Classifier gate: not equivalent to auto mode
Trade-off: highest exposure
What the default can—and cannot—do
The classifier adds a safety decision point, but it is not a guarantee. Sensitive repositories, credentials and deployment systems still require deliberate controls.
| Capability | Manual mode | Auto mode | Bypass permissions |
|---|---|---|---|
| Routine actions continue unattended | ~ Limited | ✓ Yes | ✓ Yes |
| Separate safety classifier reviews calls | ~ Not primary | ✓ Yes | × No equivalent gate |
| Can escalate for human review | ✓ By design | ✓ Yes | × Generally skipped |
| Eliminates all harmful actions | × No | × No | × No |
| User or administrator configurable | ✓ Yes | ✓ Yes | ~ Policy dependent |
From proposed action to execution
The safety classifier operates as a checkpoint between Claude’s plan and the actual tool call.
Claude plans
A file edit, command or external tool action is proposed.
Classifier reviews
Context and potential consequences are assessed.
Risk is scored
Destruction, unfamiliar targets and injection signals matter.
Allow or escalate
Routine work proceeds; suspicious actions may be stopped.
Session continues
Long-running tasks require fewer approval interruptions.
Promising numbers, limited verification
Anthropic’s study suggests automated review can outperform fatigued humans in a controlled setting. The results remain company-reported and have not been independently reproduced.
Reported harmful-action detection
Anthropic study: 1,053 paid testers, with a harmful action inserted into each participant’s session. Figures are not independently verified.
Preview to standard posture
In five months, auto mode moved from an experimental safety layer to the starting configuration for several paid Claude Code plans.
Research preview
Introduced as a safer alternative to disabling permission checks.
General availability
Auto mode graduates from preview and becomes broadly available.
Default enabled
New Pro, Max and Team sessions begin in auto mode.
Review trust boundaries now
Organizations should treat the new default as a policy decision, especially where agents can reach credentials, deployments, customer data or untrusted code.
Practical controls
- Define which repositories and infrastructure Claude Code may access.
- Use isolated environments for sensitive or untrusted workloads.
- Protect credentials and restrict deployment privileges.
- Set managed permission policies for Team users.
- Monitor false blocks, unsafe passes and real-world incident patterns.
“It reduces prompts but does not guarantee safety.”
Anthropic’s stated limitation
Auto mode shifts trust from repeated human approval to automated risk classification.
The result may be smoother, longer-running coding sessions, but the classifier remains an imperfect control. Users can switch modes, administrators can impose restrictions, and high-risk work still benefits from isolation and human review.
Claude Takes More Execution Control
The default changes the balance between human approval and agent autonomy. Instead of pausing repeatedly for confirmation, Claude Code can edit files, run commands and continue multi-step tasks while the classifier decides when human review is warranted. For developers, the immediate effect is likely to be fewer permission prompts and less time monitoring an active session.
Anthropic says Team and Enterprise customers using auto mode produced about 25% more pull requests. That figure comes from the company and has not been independently confirmed. The wider consequence is that a safety system once offered as an optional layer now becomes the standard operating posture for several paid plans.
OBD2 Scanner, MUCAR 632 Elite AI-Assisted Bidirectional Scan Tool, 15 Reset Services Oil/TPMS/EPB/BMS/SAS/Brake/Throttle Car Scanner Diagnostic Tool, AutoAuth FCA, CANFD, AutoVIN, Lifetime Free Update
- Lifetime Free Updates: No subscription fees, lifelong updates included
- AI-Assisted Troubleshooting: Instant AI analysis and repair suggestions
- Comprehensive Code Reading: Reads and erases engine, ABS, SRS, transmission codes
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From Preview to Default Setting
Anthropic introduced auto mode in March 2026 as a research preview and described it as a safer alternative to the command that disables permission checks. It later made the feature generally available in July 2026 before changing the default for Pro, Max and Team subscribers.
The company has argued that repeated approval requests can create permission fatigue. In an Anthropic study involving 1,053 paid testers, the company inserted a harmful action into each participant’s session. Anthropic said auto mode blocked 89% of those actions, compared with 13.6% blocked by people reviewing prompts manually. Human detection reportedly fell to about 5% after 50 earlier prompts.
“Auto mode lets Claude execute without permission prompts.”
— Anthropic
As an affiliate, we earn on qualifying purchases.
Classifier Limits Remain Unproven
It is not yet clear how auto mode will perform across unfamiliar production environments, hostile repositories or unusual command chains. Anthropic has not published enough detail for outsiders to reproduce every result behind its comparison of automated and human review.
The reported 89% detection rate also means the test system did not stop every harmful action. A classifier may miss unsafe behavior or block legitimate work, and a misleading file can attempt to steer an agent through prompt injection. Users handling credentials, deployment systems or untrusted code still face risks that a default setting cannot remove.
As an affiliate, we earn on qualifying purchases.
Teams Must Review Permission Policies
Pro, Max and Team users should see auto mode selected for new sessions following the August 14 change. Users who want more frequent confirmation can choose another permission mode, while administrators can use managed configuration to limit or disable auto mode.
Attention will now turn to real-world incident data, false blocks and any revisions Anthropic makes to the classifier. Organizations adopting the default will need to decide which repositories and infrastructure the system may trust, and whether sensitive work belongs in isolated environments.
As an affiliate, we earn on qualifying purchases.
Key Questions
What does Claude Code auto mode do?
Auto mode allows Claude Code to continue working without asking for approval before every action. A separate safety classifier reviews tool calls and can block or escalate actions it judges unsafe.
Which Claude plans receive the new default?
The August 14 default applies to Pro, Max and Team users. Availability and administrative controls may differ by plan, model and provider, so organization settings can still affect whether the mode is usable.
Can users turn auto mode off?
Yes. Users can select a different permission mode, and Team administrators can impose managed restrictions. Changing the default does not eliminate those controls.
Is auto mode guaranteed to prevent harmful commands?
No. Anthropic says the feature does not guarantee safety. Its reported detection figures come from company testing, and users should still review output, protect credentials and isolate high-risk or untrusted workloads.
Source: Anthropic
Source: Anthropic
