Anthropic Makes Claude Code Auto Mode Default August 14, Citing 89% Dangerous-Command Block Rate

Anthropic is making auto mode the default permission setting for new Claude Code sessions on Pro, Max, and Team plans from August 14, 2026, citing tests where the system blocked substantially more dangerous commands than human reviewers.

 

TL;DR

 

• New Claude Code sessions on Pro, Max, and Team plans will default to auto mode from August 14.
• Anthropic says auto mode blocked 89% of dangerous commands in a 1,053-person controlled study, compared with 13.6% caught by human reviewers.
• Enterprise and several cloud deployments remain opt-in for now, while users can still switch permission modes or configure human checkpoints.

 

Anthropic is giving Claude Code more freedom to work without repeatedly asking developers for permission.

Starting August 14, new sessions for Pro, Max, and Team users who have not pinned another permission mode will automatically begin in auto mode. Users who have already chosen a different default may receive a one-time prompt asking whether they want to switch, while organization-managed defaults will remain unchanged.

The company is also removing charges for the additional classifier tokens used by auto mode for Pro, Max, and Team customers.

 

How Claude Code Auto Mode Works

 

Instead of asking for approval before routine actions, auto mode routes tool calls through a classifier designed to identify actions that are irreversible, destructive, or directed outside the user's environment.

When an action is blocked, Claude Code can attempt a safer alternative or ask the user for explicit approval. If the system encounters three consecutive blocks or 20 blocks across one session, it falls back to manual approvals, according to Anthropic's announcement.

Developers and organizations can still configure stricter controls. Anthropic's Claude Code auto mode documentation supports explicit ask rules that force human approval for selected actions, while deny rules can prevent specific operations before they reach the classifier.

For example, teams can require approval before every Git push or pull request while continuing to use auto mode for other operations.

 

Anthropic Says Auto Mode Beat Human Review In Safety Test

 

Anthropic based the change partly on a controlled study involving 1,053 paid professional testers.

During the experiment, one permission prompt in each test session was replaced with the description of a clearly dangerous command. No harmful command was actually executed, with researchers measuring whether participants would approve what they saw.

According to Anthropic, human reviewers identified the dangerous command in 143 of the 1,053 cases, representing 13.6%. Auto mode blocked 937 of the same commands, or 89%.

Source

The difference became more pronounced as sessions grew longer. Human participants blocked around 17% of dangerous commands early in a session, but that figure declined to roughly 5% after more than 50 previous permission prompts, while Anthropic said auto mode's block rate remained stable.

This supports one of Anthropic's main arguments for the change: permission prompts may stop functioning as an effective safety mechanism when developers become accustomed to approving them.

The company says Claude Code users currently approve 97% of permission prompts. It also reported that 62% of users have either used bypassPermissions or selected a "don't ask again" option for Bash commands, while 25% of interactive sessions begin in bypass permissions mode.

Anthropic also analyzed real-world sessions flagged by its safety systems between May and June 2026. At what the company classified as production-level severity, 6.3% of manually approved flagged sessions contained unintended harmful actions, compared with 2.4% of auto mode sessions.

 

Claude Code Auto Mode Gets More Prompt Injection Defenses

 

Anthropic has also added protections intended to reduce the risk of prompt injection attacks and data exfiltration.

External content retrieved from web pages, files, and tool results can be screened for potentially malicious instructions, while the classifier considers factors including repository visibility, Git status, trusted destinations, and data-sharing rules.

Anthropic also commissioned Trajectory Labs to test Claude Code and Codex against 72 indirect prompt-injection scenarios, each run 10 times.

Source

Anthropic reported that none of the 720 attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 while running auto mode. The same company-published results reported a 5.83% attack success rate against GPT-5.6 Sol running Codex Auto-review mode.

However, Anthropic noted important limitations to that comparison. The tests used a common third-party browser integration rather than the companies' first-party browser safeguards, while Anthropic said OpenAI released a newer Auto-review version after the evaluation was conducted.

 

Independent Research Shows Auto Mode Still Has Limits

 

Auto mode does not eliminate risk, and separate research has identified scenarios where the permission system can struggle.

An April 2026 research paper published on arXiv tested Claude Code auto mode using 128 deliberately ambiguous DevOps prompts covering 253 state-changing actions. Researchers reported an 81% end-to-end false-negative rate under that stress-test setup.

Source

However, the researchers explicitly said the result represented a fundamentally different workload from Anthropic's production testing and should not be treated as a direct contradiction of Anthropic's reported figures.

The study found that some risky actions could occur through in-project file edits outside the classifier's evaluated scope, highlighting a potential boundary in how the permission system monitors different types of actions.

What Anthropic Customers Say About Auto Mode

 

Anthropic says companies including Adobe, Nuro, Gusto, and Garner Health already use auto mode as a production default.

Among Teams and Enterprise adopters, Anthropic reported that auto mode users produce around 25% more pull requests, which it attributes to agents being able to work for longer periods without interruptions.

“Auto mode gave us a safer balance between speed and control,” said Martin Emde, Software Engineer at Gusto, in Anthropic's customer examples.

Anthropic also described three internal cases where auto mode stopped potentially damaging actions, including an attempted fallback that would have uploaded internal material to a public code-sharing site, a mass process-kill operation affecting roughly 2,000 pods, and an attempt to grant overly broad cloud privileges.

 

Who Gets Claude Code Auto Mode By Default

 

The August 14 change applies to new sessions for Claude Code users on Pro, Max, and Team plans.

Enterprise users and customers accessing Claude Code through the Claude API and several cloud platforms remain opt-in for the time being. Anthropic says it plans to expand the default setting to these environments in the coming month, while Enterprise administrators can already configure auto mode through managed settings.

Users can switch between permission modes through Claude Code, while administrators can disable auto mode entirely or enforce organization-wide configurations.

Despite making auto mode the default, Anthropic cautions that the technology still relies on classification systems and cannot remove every risk.

For high-stakes changes involving production infrastructure, developers should continue reviewing consequential actions rather than treating automated permissions as a replacement for security controls.