Anthropic Defaults Claude Code to Auto Mode After Humans Miss 86% of Threats

Anthropic flips the switch on AI agent autonomy

Anthropic will make auto mode the default setting for Claude Code on August 14 for Pro, Max, and Team plan subscribers, eliminating the per-action permission prompts that most developers were approving reflexively anyway. The change reflects a bet that automated safety classifiers outperform fatigued humans at catching dangerous commands during coding sessions.

The company's decision rests on two data sets. First, internal usage logs showed users approve 97% of permission requests — a number Anthropic interprets not as careful review but as evidence that manual approval has become meaningless friction. Second, a controlled study of 1,053 paid testers revealed humans caught disguised dangerous commands only 13.6% of the time, while auto mode's classifier caught 89%.

That gap widened as sessions lengthened. After 50 or more prompts, human catch rates dropped to roughly 5%, while the classifier's detection rate held steady regardless of session duration.

Production data shows manual approval correlates with more harm

Anthropic examined flagged sessions from May and June and found that manually approved sessions contained serious unintended harm at production severity — such as accidentally deleting live database rows — more than twice as often as auto mode sessions: 6.3% versus 2.4%.

Auto mode works by routing each tool call through a classifier trained to interrupt only when an action appears irreversible, destructive, or targets resources outside the user's environment. The system includes hard denies for categories like data exfiltration, checks git status before destructive commands, and screens external content for prompt injection attempts. If the classifier blocks a command three times consecutively or twenty times in a session, Claude Code reverts to manual approval.

Third-party testing from Trajectory Labs ran 720 prompt injection attacks against Claude Code's auto mode and OpenAI's Codex. None succeeded against Claude Code; Codex's comparable mode had a 5.83% success rate on the same scenarios.

Why it matters

The shift from per-action approval to boundary-setting before execution represents a fundamental change in how organizations govern AI agents. Teams accustomed to auditing individual commands must now define permissions and constraints upfront, then audit what ran after the fact. That requires different tooling, different skills, and a different relationship between developers and compliance functions. Companies that treat this as a simple settings change will likely discover gaps in their governance model when the first unreviewed action causes a production incident.

Anthropic also reports teams using auto mode ship approximately 25% more pull requests than those using manual review. Nuro described starting an agent at 10 p.m. and receiving three completed pull requests by morning — a workflow manual approval made impractical.

Rollout details and enterprise caution

The default change applies only to Pro, Max, and Team plans initially. Auto mode remains opt-in for Claude Enterprise, the Claude API, and deployments on AWS, Google Cloud, and Microsoft Foundry. Anthropic plans to extend the default to those channels within the next month, giving enterprise administrators time to evaluate the change. Enterprise admins can enable auto mode now through managed settings.

Anthropic is also removing the token surcharge previously tied to the classifier's overhead for Pro, Max, and Team users. Users who manually selected a different permission mode will receive a one-time prompt asking whether they want to switch, rather than being migrated automatically.

Adobe, Gusto, and Garner Health are already running auto mode as their production default, with Garner deploying it to all 550 employees.

These details were first reported by DevOps.com.