Anthropic to default Claude Code to auto mode, cutting human approval prompts

Anthropic announced Friday that Claude Code's auto mode will become the default setting for new sessions on Pro, Max, and Team accounts beginning August 14, replacing the manual approval prompts that developers have long clicked through with little scrutiny. The change hands routine permission decisions to a proprietary classifier, which evaluates each tool call and intervenes only when an action is deemed irreversible, destructive, or directed outside the user's environment.techcrunch+1

The Case Against Manual Review

The shift is rooted in what Anthropic describes as confirmation fatigue. According to the company, users approve 97% of permission prompts in Claude Code, a rate that suggests the safety mechanism had become reflexive rather than protective. Internal telemetry reinforces the pattern: by June, 62% of users had tried bypassing permissions or selected "don't ask again" for Bash commands, and 49.5% of active CLI users had created a Bash allow rule.techi+1

In a study with 1,053 paid testers, Anthropic planted a clearly dangerous command among routine permission prompts. Auto mode blocked 89% of those commands; human testers refused only 13.6%. Human vigilance dropped further as sessions lengthened, falling to roughly 5% after 50 or more prompts.techcrunch+2

Claude Code head Boris Cherny wrote on X that his team has used auto mode exclusively "for many months" and could not imagine returning to permission prompts.techcrunch

Residual Risks and Independent Testing

The 89% block rate leaves an 11% miss rate — 116 of 1,053 planted commands passed through undetected. A separate synthetic adversarial evaluation conducted with Apollo Research brought the miss rate down to 7% after classifier hardening, though Anthropic noted that figure comes from a deliberately hostile dataset and is not a real-traffic measurement.techi

On prompt injection, Anthropic commissioned Trajectory Labs to run 720 indirect injection attacks against Claude Fable 5, Opus 5, and Sonnet 5 in auto mode. None succeeded. Developer and researcher Simon Willison, however, cautioned that a zero-success rate on curated scenarios does not guarantee resilience against supply-chain-style attacks, such as malicious third-party packages that instruct an agent to fetch and execute additional files.cryptonomist

Guardrails and Scope

When auto mode blocks an action, Claude attempts a safer alternative or asks for explicit authorization. Three consecutive denials or 20 total in an interactive session revert the tool to manual approvals; headless runs terminate instead. Teams can further tighten controls with explicit ask rules for operations like pushes or pull requests, and deny rules that cannot be overridden.techi

Anthropic confirmed it will not charge Pro, Max, and Team users for the small token overhead the classifier adds per tool call. Enterprise, API, and platform deployments on Amazon Web Services Amazon.com, Inc. ↗ 0.82%, Google Cloud Alphabet Inc. ↘ 0.88%, and Microsoft ↗ 0.03% Foundry remain opt-in while a broader rollout is prepared.cryptonomist+1