Claude Code Makes Acting Without Asking the Default

On 14 August, Claude Code changes what happens when you don’t answer. For new sessions on the Pro, Max and Team plans, the coding assistant will stop asking permission before it runs a command and start running it — screened not by you, but by a classifier trained to block the genuinely dangerous stuff. Anthropic calls this auto mode, and from that date it becomes the default.

To its credit, the company has made the safety argument in public and with numbers, which is more than most of the industry manages. The evidence that auto mode is safer than the thing it replaces is real, specific, and worth taking seriously. That is exactly why the interesting question isn’t whether auto mode is good. It’s that a change in how autonomously your agent behaves is arriving as an opt-out, on top of a class of attack the whole industry admits it cannot fully fix.

This is a defaults story, not a scare story. The short version: the safety case is strong, the consent case is thin, and the direction of travel — more autonomy, switched on for you rather than by you — is the part worth watching.

What actually changes on the 14th

Until now, Claude Code’s standard behaviour was to pause and ask before doing anything consequential: running a shell command, editing a file, pushing to a repository. Auto mode removes that pause for most actions. Instead, every tool call is routed through a classifier aimed at blocking actions that are “irreversible, destructive, or aimed outside your environment”. When it blocks something, Claude either finds a safer route or asks you directly; if it gets stuck — three blocks in a row, or twenty across a session — it falls back to manual approvals.

The rollout is narrower than the headline suggests, and Anthropic is upfront about the mechanics:

• Who it hits: new sessions on Pro, Max and Team plans from 14 August. Enterprise and API access stay opt-in “for now”, with a plan to switch them within about a month.
• If you never set a default: new sessions simply start in auto mode. No decision required, because the decision was made for you.
• If you did set a default: you get a one-time prompt asking whether to switch. A default you pinned, or one your Team admin pinned in managed settings, is left untouched.
• The bill: the classifier burns a few extra tokens per tool call, and Anthropic is no longer charging Pro, Max and Team users for that overhead — a genuinely fair call.

Concede the good bits plainly, because there are several. Dropping the classifier charge is the right move. Keeping pinned and admin-set defaults sacrosanct is the right move. And auto mode is not a blank cheque: data exfiltration sits in a category the classifier is designed to never approve, and permission deny-rules still fire first.

The steel-man: their safety numbers are good

It would be lazy to wave this away. Anthropic spent months testing auto mode against the honest baseline — not a careful expert, but a normal user clicking through prompts — and published the results. In a controlled study with 1,053 paid testers, a single clearly dangerous command was slipped into each session. The humans caught it 13.6% of the time. Auto mode caught 89%. Head to head, auto mode blocked 800 commands a human waved through, while humans blocked six that auto mode allowed.

The pattern held elsewhere. Re-grading real sessions its safety pipeline had flagged, Anthropic found that manually approved sessions contained serious unintended harm more than twice as often as auto-mode ones. A two-week red-team engagement with Apollo Research cut the classifier’s miss rate on held-out attacks from 12% to 7%. And in a third-party prompt-injection evaluation, none of 720 attack attempts succeeded against Claude’s models running auto mode. It even names three incidents auto mode caught internally: a report about to be published to a public code-sharing site after an upload failed, a mass process-kill that would have torn down hundreds of GPUs of running training jobs, and a request for read-only billing access that reached for full root admin instead.

That is a stronger evidence base than almost any “we improved safety” announcement you will read this year. Take it at face value: for the median user, reflexively approving prompts all day, auto mode really does appear to catch more of the things that would ruin an afternoon.

“You approve 97% anyway” is a diagnosis, not a mandate

Here is the load-bearing statistic in Anthropic’s case, and it is worth sitting with. Users approve 97% of permission prompts in Claude Code. Only 3% are rejected. The company reads this, reasonably, as evidence that people are clicking through reflexively rather than reviewing each command — and that a prompt everyone rubber-stamps is not really protecting anyone.

But notice the same document reports that when Claude presents a plan for approval, users reject 39% of them. So people are perfectly capable of meaningful consent when the decision is framed at the right altitude; they just won’t adjudicate every individual `chmod`. That points to at least two possible fixes. One is to remove the prompt and let a classifier decide. The other is to ask fewer, better questions — consent at the level of the plan, not the keystroke. Anthropic has chosen the first. It is a defensible choice, and it is not the only one. A prompt that everyone ignores is a design failure, but the failure can be answered by improving the prompt as easily as by deleting it.

This connects to a pattern we keep noticing: the friction users hate is real, but removing friction and removing control are not the same thing, and vendors have an incentive to conflate them. We made the same point about products that hide the meter in the name of simplicity.

A classifier is a model guarding a model

The uncomfortable structural fact is that auto mode replaces your judgement with a machine-learning classifier — a probabilistic system deciding, in real time, whether another probabilistic system is about to do something you’ll regret. Anthropic is admirably honest that this is not airtight. After hardening, the classifier still missed about 7% of a deliberately adversarial attack set. Among audited auto-mode sessions, 2.4% still contained a production-level harmful action the user had not explicitly asked for — better than the 6.3% under manual approval, but not zero. And the company is careful to say the 7% figure is measured against synthetic attacks “built to find where the classifier fails” and should not be read as the miss rate on real traffic.

All fair. But it cuts both ways. “Matched or outperformed manual review” is a comparative claim, not a safety guarantee, and it invites a subtle shift in responsibility. When you approved a command and it went wrong, that was on you. When a classifier approves a command and it goes wrong, whose call was it? The honest answer is that auto mode lowers the rate of bad outcomes while removing the moment where a human might have caught the one that matters. For most sessions that trade is worth it. For the session where it isn’t, there is no longer a prompt.

Your own settings get quietly reinterpreted

One detail deserves more attention than it will get. In auto mode, broad allow-rules you set yourself — the ones that grant arbitrary code execution, like `Bash(python:*)` — are “set aside”, because they would let commands skip the classifier entirely. Your settings file isn’t edited, and the rules snap back the moment you leave auto mode. The rationale is sound: a rule broad enough to run anything defeats the whole point of a screen.

Still, pause on what that means. Anthropic’s own numbers show how common those rules are — as of June 2026, nearly half of active CLI users had created a Bash allow-rule, and 62% had used `bypassPermissions` or clicked “don’t ask again”. For a lot of people, auto mode will not behave the way their configured settings say it should, because the mode overrides them by design. That is probably the right security decision. It is also a reminder that in auto mode the last word on what runs belongs to the classifier, not to the config you wrote.

Why this lands at an awkward moment

None of this happens in a vacuum. The industry’s current obsession is agents — assistants wired to real tools that read your files, browse the web and run commands — and the more autonomous they get, the larger the blast radius when something goes wrong. We wrote last week about prompt injection, the still-unsolved flaw where text hidden in content an agent reads can hijack what it does. Auto mode explicitly tries to blunt that — it scans tool results for injected instructions and checks actions against your intent — and the evaluation numbers are encouraging. But “reduces” is the operative word. Making autonomous operation the default the same season the sector concedes it cannot fully close the injection hole is, at minimum, a bold sequencing.

It also sharpens an older tension. The pitch for coding agents has always leaned on throughput — auto-mode adopters “ship about 25% more PRs”, the announcement notes — and we’ve been sceptical before of productivity numbers that measure output rather than value. More PRs is not obviously more good software, and “leave it running for hours” is a feature that reads differently depending on whether you’re the person shipping or the person reviewing the pull request at 9am.

What you can actually do

The reasonable posture here is neither alarm nor a shrug. Auto mode is a real safety improvement over reflexive clicking, and if that describes how you use Claude Code, letting the switch happen is a defensible choice. The point is to make it a choice.

• Decide before the 14th. If you want to keep the ask-first behaviour, set and pin your default now — Shift+Tab in the CLI, or the mode dropdown on desktop — so you don’t get switched silently. A default you set yourself is respected.
• Take the one-time prompt seriously. If you already have a default, you’ll be asked once. That prompt is the consent moment; don’t reflex-click the thing whose entire premise is that you reflex-click things.
• Admins: pin it deliberately. On Team and Enterprise, use `defaultMode` in managed settings to set an org-wide choice, or `disableAutoMode` to turn it off. Add `hard deny` rules for anything you never want approved, even on request.
• Don’t hand it the whole trifecta. Auto mode or not, be wary of one session that combines access to secrets, exposure to untrusted external content, and the ability to push or send outward — the combination is where autonomy turns expensive.
• Watch the next month. Enterprise and API are next, “in the coming month”. If you administer those, the notice is now.

Defaults are policy. Most people never change them, which is precisely why the choice of default is a decision the vendor makes on behalf of everyone who won’t. Anthropic has picked autonomy, backed it with more evidence than the norm, and left you a door out. That is a better version of this move than we usually get to write about. It is still worth knowing that the door is there — and walking through it on purpose, in whichever direction you actually want.