Claude Code turns on auto mode by default

Anthropic is making auto mode the default in Claude Code for Pro, Max, and Team plans on August 14, and the reasoning is more interesting than the switch itself. Auto mode lets Claude Code run commands without stopping to ask for approval at each step, and the company's case is that constant approval prompts make people less safe, not more. In a study of 1,053 paid developers, when a dangerous command was slipped in where a normal permission prompt would appear, humans blocked it only 13.6% of the time. Auto mode, which screens each action with a classifier, blocked 89% of the same commands.

The decay is the part worth noting. Human reviewers caught about 17% of dangerous commands early in a session but dropped to 5% after fifty or more prompts, while the classifier held steady. In real sessions, unintended dangerous actions showed up in 6.3% of manually approved runs versus 2.4% under auto mode. Anthropic also had Trajectory Labs run 720 prompt injection attempts across 72 scenarios against Claude Fable 5, Opus 5, and Sonnet 5, and says none succeeded. Safeguards include hard rules against data exfiltration, git status checks, and a limit of three consecutive or twenty total automated tool calls before it reverts to manual approval. The company also stopped charging paid users for the classifier overhead.

Simon Willison, who covered the rollout, is impressed but not sold: he points to the roughly 11% auto mode still misses and doubts it stops a determined attacker hiding instructions inside a package.

Why it matters

If you use Claude Code on a paid plan, approval prompts stop being your safety net on August 14, so decide now whether you trust the classifier or want to turn auto mode off. The data suggests that clicking "approve" dozens of times a session was never really protecting you anyway.