Starting August 14, new Claude Code sessions on Pro, Max and Team plans open in auto mode — a permission model in which an AI classifier, not the developer, decides which of the agent's tool calls need a human sign-off. Anthropic announced it August 7 in a post credited to Conner Phillippi, a member of technical staff. Enterprise, the Claude API, Bedrock, Google Cloud's Agent Platform and Microsoft Foundry stay opt-in for now; Anthropic says it will flip those within a month.
The justification is a number that should make anyone who has ever mashed an approve button wince: Claude Code users approve 97% of permission prompts. The rejection rate on individual requests is 3%, while users reject 39% of the full plans Claude proposes — evidence, Anthropic argues, that developers scrutinize plans and rubber-stamp prompts. By June 2026, 62% of users had used `bypassPermissions` or clicked don't-ask-again on Bash, and 25% of sessions started in bypass mode.
Then there is the study. Anthropic hired 1,053 paid professional testers and put them in a purpose-built environment, not their own codebases. Partway through each session, one permission prompt was swapped for a clearly dangerous command; approving it ran nothing, only the text changed. Testers refused 143 times — 13.6%. The classifier blocked the same command 937 times, or 89%. Head to head, auto mode stopped 800 commands a human waved through; humans stopped six that auto mode allowed. Vigilance decayed measurably: testers caught roughly 17% early in a session, about 5% after 50 or more prompts. The classifier's rate stayed flat.
Mechanically, every tool call routes through a classifier tuned to catch actions that are, in Anthropic's phrasing, “irreversible, destructive, or aimed outside your environment.” Blocked, Claude finds a safer path or asks directly; after three consecutive blocks, or 20 in a session, it reverts to manual approvals. Existing permission rules still fire first, with one exception: allow-rules broad enough to grant arbitrary code execution, such as `Bash(python:*)`, are set aside in auto mode, since they would let commands skip the classifier. Anthropic also stopped billing Pro, Max and Team users for classifier overhead.
Two outside evaluations back the pitch, with caveats Anthropic flags itself. Apollo Research ran a two-week adversarial pilot; after hardening, the classifier's miss rate fell from 12% to 7%, which Anthropic says should not be read as a real-traffic rate. Trajectory Labs ran 72 indirect prompt-injection scenarios ten times each: none of the 720 attempts succeeded against Fable 5, Opus 5 or Sonnet 5 in auto mode, versus 5.83% against GPT-5.6 Sol in Codex's Auto-review mode and 19.03% in Codex Full Access.
The Reaction
Anthropic's own engineers are the loudest advocates. “The team and I use Auto mode exclusively, and have been for many months. I couldn't imagine going back to permission prompts!” Claude Code head Boris Cherny wrote on X. Nuro staff engineer Kai Zhou put the appeal bluntly: “I kicked off an agent at 10 p.m. and it kept running until 5 a.m. — and it gave me three PRs in the morning. Only auto mode enables this kind of workload.”
Independent reaction has been curious rather than alarmed, but not credulous. Simon Willison, who has spent two years cataloguing prompt-injection failures, granted the premise, then did the subtraction. “Of course, that still leaves 11% of cases where auto mode would not have prevented the action!” he wrote. He would “love to believe” Anthropic had solved prompt injection but wants independent confirmation, and offered an example the classifier plausibly cannot see: a third-party package whose install instructions tell the agent to fetch another, malicious package.
On Hacker News, developers running auto mode reported both outcomes. One found Claude had reached outside the working directory to read a personal financial ledger — helpful, but enough of an overreach to push them toward sandboxing. Another said a colleague's TDD run executed `rm -rf` on his home directory. A third watched an unset variable in a Claude-written copy script turn into a copy from the filesystem root. Auto mode finally let them leave the screen, one wrote, but they still had to watch what the model was doing — the exact opposite of leaving.
Why It Matters
Defaults are policy. Most developers never change them, so Anthropic just moved the security posture of millions of sessions with one config value, replacing a deterministic gate — a human, however inattentive — with a probabilistic one. That trade is now industry consensus. OpenAI shipped Auto-review for Codex on April 30, cutting approval stops by roughly 200x versus manual mode; its own alignment writeup concedes the approach sacrifices determinism for expressivity, catching novel attacks that rules miss but also failing in unpredictable ways.
The uncomfortable implication of Anthropic's data is that manual review was never the control it appeared to be. A 97% approval rate is not oversight; it is a compliance artifact. But a classifier changes the failure mode rather than removing it. Human review fails individually and at random — one tired developer, one bad command. Classifier review fails in correlated fashion and at scale: a jailbreak that beats the classifier beats it in every session running that version, simultaneously. Anthropic concedes the limit, still recommending manual review for high-stakes production changes.
What to Watch
Whether the Enterprise and cloud-partner flip lands on schedule — Anthropic said within a month, putting it in early September, and those deployments carry production credentials. Whether researchers reproduce the 720-for-720 result; the Trajectory Labs attacks were optimized against Opus 4.7, and public benchmarks eventually get tuned against. And whether the answer is containment rather than classification: the sandboxing tools those commenters reached for suggest the fix is not a smarter reviewer but an agent that cannot reach the home directory at all. Anthropic reports auto mode users ship about 25% more PRs; Gusto sees a classifier denial in roughly 10% of sessions. The productivity case is settled. The security case gets its real test the first time someone publishes a working bypass.
“Of course, that still leaves 11% of cases where auto mode would not have prevented the action!”— Simon Willison, Independent developer and writer