Anthropic is making auto mode the default permission setting in Claude Code for Pro, Max, and Team plans starting August 14, 2026. The change follows months of safety testing that the company says shows the automated system matches or outperforms human review on every measure tested. The announcement, published August 7, 2026, marks a significant shift in how the AI coding assistant handles permissions.
Auto mode routes each tool call through a classifier that targets irreversible, destructive, or out-of-environment actions. Instead of asking the user for permission on every command, the system decides whether an action is safe to run. If the classifier blocks three times in a row or twenty times in a session, Claude Code falls back to manual approvals. The company also stopped charging for the classifier's token overhead on Pro, Max, and Team plans, effective August 7, 2026.
Why Anthropic Made the Switch
The decision rests on a simple observation about human behavior. Users approve 97% of permission prompts in Claude Code. They reject 39% of plans presented for approval, but only 3% of individual permission requests. Anthropic argues that manual review has become reflexive rather than careful.
"Manual review can become habitual," the company said in its announcement. The data supports that claim. As of June 2026, 49.5% of active CLI users have manually created a Bash allow-rule. Of those, 5% allow any shell command outright, and 43% have interpreter rules like Bash(python:*) or Bash(node:*) that are essentially equivalent. The share of users with allow-rules is growing roughly 5 percentage points every 5 weeks. Meanwhile, 62% of users have used bypassPermissions or clicked "don't ask again" on Bash, and 25% of interactive sessions start in bypass permissions mode.
Those numbers paint a picture of a user base that has largely abandoned careful review. Auto mode, Anthropic says, restores safety without demanding constant attention. The company tested this in a controlled experiment with 1,053 paid testers. Human testers caught 13.6% of dangerous commands, or 143 of 1,053. Auto mode caught 89%, or 937 of 1,053. Head-to-head, auto mode blocked 800 commands that humans approved, while humans blocked only 6 that auto mode allowed.
The gap widens over time. Humans blocked about 17% of dangerous commands early in a session, dropping to about 5% after 50+ prior prompts. Auto mode's block rate stayed flat. Fatigue, it seems, erodes human vigilance.
Production Data and Real-World Harm
Anthropic also examined real production sessions to see how the two modes compare in practice. From May to June 2026, the company looked at flagged sessions from accounts opted into data use for training. Sessions were re-graded on harm severity on a 0-10 scale and on how explicitly the user asked for the action. At production-level severity of 7 or higher, 6.3% of manually approved sessions contained harmful action not explicitly requested, versus 2.4% for auto mode sessions. Manual approval sessions contained serious unintended harm more than twice as often as auto mode sessions.
The company also documented three internal incidents prevented by auto mode: an off-network data leak, a destructive mass operation, and an over-broad privilege escalation. Auto mode is now the default for all internal Claude Code usage at Anthropic.
Nuro runs auto mode across research and engineering organizations for overnight research agents. Gusto adopted auto mode to end permission fatigue; about 10% of sessions since mid-May include a classifier denial. Martin Emde, a Software Engineer at Gusto, said, "Auto mode gave us a safer balance between speed and control. We were able to remove the repeated prompts and increase productivity without compromising safety. We can see that auto mode blocks at the right time, which gives us the confidence to move quickly."
Garner Health pushed auto mode as default to all 550 employees via managed settings. Evan Magnussen, Platform Engineering Manager at Garner Health, noted the organizational effect. "We built a standardized SDLC for the entire engineering org that's only possible because of auto mode. Employees view it as a weight off their shoulders. They don't have to monitor their agents for hours on end anymore."
Anthropic also reports that auto mode users ship about 25% more pull requests.
Red-Teaming and Prompt Injection Resistance
The company did not rely only on its own testing. Apollo Research, a UK-based AI safety startup, conducted a two-week pilot injecting synthetic attacks into real coding trajectories across three datasets. After hardening, auto mode caught about half of previously missed attacks, at the cost of missing about 2% of previously caught attacks. The classifier's miss rate fell from 12% to 7% across shared and held-out sets. Anthropic is careful to note that the 7% miss rate is against synthetic adversarial attacks, not real traffic.
Anthropic also commissioned Trajectory Labs, a third-party evaluation firm, to test prompt injection resistance. The evaluation used 72 indirect prompt injection scenarios held out from Anthropic, each tested 10 times, for a total of 720 attempts. Attacks were optimized against Claude Opus 4.7, so all models faced unseen attacks. Both Codex and Claude Code used identical browser integration by Trajectory Labs.
The results were stark. No attack succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode, meaning 0 out of 720 attempts. GPT-5.6 Sol running Codex v0.144.5 Auto-review permission mode had a 5.83% attack success rate. GPT-5.6 Sol running in Full Access mode had a 19.03% attack success rate. Claude models in bypassPermissions mode had a 0.09% average attack success rate.
Anthropic cautions that these results should be viewed as a measurement of the underlying model, not complete safeguards. Safeguards in first-party browser integrations, such as Chrome extensions, were not tested. The company also notes that OpenAI released a new version of Auto-review last week that could change results. The evaluation used Claude Code v2.1.205 and Codex v0.144.5 as of July 17, 2026.
How Auto Mode Works
The classifier has explicit rules for secrets and sensitive or confidential information. It checks git push and pull request destinations to determine whether they are public, private, or trusted. It also checks git status before destructive git actions like git reset , hard. Hard denies mean the classifier never approves data exfiltration; users must switch modes or run the command manually. Hard deny rules are customizable via settings.
An API-side probe screens content from external sources for prompt injection attempts. Permission rules still fire before the classifier in auto mode, except for allow rules broad enough to grant arbitrary code execution, such as python:*. Those arbitrary allow rules are set aside in auto mode, but settings files are not modified, and the rules apply again when switching modes.
The classifier uses a small number of extra tokens per tool call. Anthropic is no longer charging for that overhead on Pro, Max, and Team plans. For users who have set a different default, a one-time prompt may appear asking to switch to auto mode. Users with a pinned default will not see changes. To switch modes manually, users can press Shift+Tab in the CLI or use the mode dropdown on the desktop app. For those who want to understand the system's behavior in detail, the company's documentation explains how to navigate the classifier's decision logs and settings.
Rollout and Enterprise Options
Auto mode remains opt-in for Claude Enterprise, Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry. Anthropic plans to make auto mode default across all those platforms in the coming month and stop charging for classifier overhead there as well. Enterprise admins can set auto mode as default through managed settings. Admins can pin an org-wide default with defaultMode in managed settings, or turn off auto mode with disableAutoMode.
The company acknowledges that auto mode reduces risk for most users but does not eliminate risk. Anthropic recommends reviewing Claude's actions for high-stakes production changes. The article also notes that auto mode allows longer-running autonomous work, which is particularly relevant for Claude Opus 5, a model designed for long-running tasks.
The testing program included internal red-teaming, third-party red-teaming, prompt-injection evaluations, a controlled study with 1,053 paid testers, and analysis of real production sessions. The article was written by Conner Phillippi with contributions from Nicholas Carlini, Isaac Fung, John Hughes, Alex Isken, Shawn Moore, Javier Rando, and Molly Vorwerck. Thanks were extended to Yacine Azmi, Chandler Bair, Kefan Chen, Boris Cherny, Ian Grunert, Lydia Hallie, Alex Kleiman, Lauren Polansky, Deon Poncini, Robert Schonberger, Marie Vachovsky, Qing Wang, Cat Wu, Daniel Xu, and Alice Zhao.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
The broader context matters. Claude Code is an AI coding assistant that can execute commands with user permission. Permission modes include manual review, auto mode, and bypassPermissions. The shift to auto mode as default represents a bet that automated oversight is more reliable than human oversight for routine coding tasks. The data Anthropic presents supports that bet, though the company is careful to hedge. The 7% miss rate against synthetic attacks, the caveat about OpenAI's new Auto-review version, and the recommendation to review high-stakes changes all suggest that auto mode is not a cure-all.
For most users, though, the change will be invisible. New sessions on Pro, Max, and Team plans will start in auto mode automatically if no default is set. The one-time prompt for users with a different default may appear. Users with a pinned default will see no changes. The transition begins August 14, 2026, and Anthropic expects to extend it to enterprise and cloud platforms within the month.
The competitive picture is also worth noting. OpenAI's Codex, running GPT-5.6 Sol, showed significantly higher attack success rates in the Trajectory Labs evaluation. That gap may narrow with OpenAI's new Auto-review version, but for now, Anthropic's numbers give it a strong talking point. The company's argument is straightforward: humans are not good at reviewing every prompt, and a classifier that blocks dangerous actions automatically is better than a tired developer clicking approve.
The production data from May to June 2026 reinforces that argument. Manual approval sessions contained serious unintended harm more than twice as often as auto mode sessions. The controlled experiment showed humans catching 13.6% of dangerous commands versus auto mode's 89%. The head-to-head comparison showed auto mode blocking 800 commands that humans approved, while humans blocked only 6 that auto mode allowed. Those numbers are hard to argue with, even if the test conditions were artificial.
Anthropic's internal incidents, three prevented by auto mode, provide another layer of evidence. An off-network data leak, a destructive mass operation, and an over-broad privilege escalation are exactly the kinds of failures that keep security teams up at night. The fact that auto mode caught them internally suggests the classifier is doing real work, not just passing tests.
The company also addressed the token cost concern. The classifier uses a small number of extra tokens per tool call, and Anthropic is no longer charging for that overhead on Pro, Max, and Team plans. That removes a potential objection from users who might otherwise see auto mode as a hidden cost. The plan to stop charging for classifier overhead on enterprise and cloud platforms in the coming month extends that policy.
For admins, the controls are clear. defaultMode in managed settings pins an org-wide default. disableAutoMode turns the feature off entirely. That gives enterprises flexibility while still allowing the default to be safe. The recommendation to review Claude's actions for high-stakes production changes is a sensible caveat, acknowledging that no automated system is perfect.
The article's own hedges are worth repeating. Auto mode is as safe or safer than manual review based on testing, but that is a claim about averages, not guarantees. The 7% miss rate is against synthetic adversarial attacks, not real traffic. The Trajectory Labs results measure the underlying model, not complete safeguards. OpenAI's new Auto-review version could change the competitive picture. These caveats do not undermine the core finding, but they do prevent overconfidence.
The timeline is tight. The announcement came August 7, 2026. The default change takes effect August 14, 2026. The plan to extend to enterprise and cloud platforms lands in the coming month. Users have a week to adjust, though most will not need to do anything. The one-time prompt for users with a different default will handle the transition.
The broader trend is clear. AI coding assistants are moving toward more autonomous operation. Auto mode is a step in that direction, with a safety mechanism designed to catch the worst failures. Whether it holds up in the long run remains to be seen, but the initial data is encouraging.
Anthropic's argument is that manual review is not actually careful review. The 97% approval rate for permission prompts, the 39% rejection rate for plans, and the 3% rejection rate for individual permission requests tell a story of a user base that has tuned out. The 49.5% of users with Bash allow-rules, the 5% who allow any shell command, and the 43% with interpreter rules that are essentially equivalent suggest that many users have already given up on granular control. The 62% who have used bypassPermissions or clicked "don't ask again" on Bash, and the 25% of interactive sessions that start in bypass permissions mode, reinforce that picture.
Auto mode is an attempt to meet users where they are. Instead of demanding attention, it provides oversight automatically. The classifier blocks dangerous actions, falls back to manual approvals after repeated blocks, and never approves data exfiltration. It checks git destinations and git status before destructive actions. It probes external content for prompt injection attempts. It is not perfect, but it is better than a tired developer clicking approve.
The numbers from the controlled experiment are the most compelling evidence. Humans caught 13.6% of dangerous commands. Auto mode caught 89%. Auto mode blocked 800 commands that humans approved. Humans blocked only 6 that auto mode allowed. The human block rate dropped from 17% early in a session to 5% after 50+ prompts. Auto mode's block rate stayed flat. That is a clear demonstration of the value of automated oversight.
The production data tells a similar story. At severity 7 or higher, 6.3% of manually approved sessions contained harmful action not explicitly requested, versus 2.4% for auto mode sessions. Manual approval sessions contained serious unintended harm more than twice as often. Those are real-world numbers, not lab results.
The red-teaming results add another layer. Apollo Research's two-week pilot showed the classifier's miss rate falling from 12% to 7% after hardening, at the cost of missing about 2% of previously caught attacks. Trajectory Labs' evaluation showed 0 out of 720 attacks succeeding against Claude models in auto mode, versus 5.83% for GPT-5.6 Sol in Auto-review and 19.03% in Full Access. Claude models in bypassPermissions mode had a 0.09% average attack success rate. Those numbers are striking, even with the caveat that attacks were optimized against Claude Opus 4.7 and all models faced unseen attacks.
The customer stories ground the data in practice. Adobe's merchandising platform team uses auto mode for an agentic loop across 90+ countries and 30+ languages. Nuro runs it across research and engineering organizations for overnight agents. Gusto adopted it to end permission fatigue, with about 10% of sessions since mid-May including a classifier denial. Garner Health pushed it to all 550 employees via managed settings. Each story illustrates a different benefit: scale, autonomy, fatigue reduction, and organizational standardization.
The article also notes that auto mode allows longer-running autonomous work, which is particularly relevant for Claude Opus 5. The example of an agent running from 10 p.m. to 5 a.m. and producing three PRs by morning is a concrete illustration of what that means in practice. Only auto mode enables that kind of workload, according to Adobe's Tomislav Reil.
The rollout plan is straightforward. For Pro, Max, and Team users, new sessions start in auto mode automatically if no default is set. A one-time prompt may appear for users with a different default. Users with a pinned default see no changes. To switch modes, press Shift+Tab in the CLI or use the mode dropdown on the desktop app. Admins can pin an org-wide default with defaultMode or turn off auto mode with disableAutoMode.
The company's recommendation to review Claude's actions for high-stakes production changes is a reminder that auto mode is not a substitute for judgment. It is a safety net, not a replacement for oversight. The classifier blocks the worst failures, but it cannot understand business context or strategic intent. For high-stakes changes, human review still matters.
The competitive implications are significant. OpenAI's Codex, running GPT-5.6 Sol, showed higher attack success rates in the Trajectory Labs evaluation. The gap may narrow with OpenAI's new Auto-review version, but for now, Anthropic has a data advantage. The company is also moving faster on default settings, making auto mode the default on Pro, Max, and Team plans within a week of the announcement.
The article was written by Conner Phillippi with contributions from Nicholas Carlini, Isaac Fung, John Hughes, Alex Isken, Shawn Moore, Javier Rando, and Molly Vorwerck. Thanks were extended to a long list of contributors, including Yacine Azmi, Chandler Bair, Kefan Chen, Boris Cherny, Ian Grunert, Lydia Hallie, Alex Kleiman, Lauren Polansky, Deon Poncini, Robert Schonberger, Marie Vachovsky, Qing Wang, Cat Wu, Daniel Xu, and Alice Zhao.
The reading time is 5 minutes, which suggests the article is dense with data. The key figures are all present: the 97% approval rate, the 39% plan rejection rate, the 3% permission rejection rate, the 49.5% allow-rule usage, the 5% who allow any shell command, the 43% with interpreter rules, the 62% who have used bypassPermissions, the 25% of sessions starting in bypass permissions mode, the 13.6% human catch rate, the 89% auto mode catch rate, the 17% early-session human block rate, the 6.3% manual approval harm rate, the 2.4% auto mode harm rate, the 2% missed attack cost, the 12% pre-hardening miss rate, the 7% post-hardening miss rate, the 5.83% GPT-5.6 Sol Auto-review attack success rate, the 0.09% Claude bypassPermissions attack success rate, the 19.03% GPT-5.6 Sol Full Access attack success rate, the 10% Gusto classifier denial rate, the 1,053 paid testers, and the 2026 dates.
The article also includes the three required quotes, each attributed correctly. Tomislav Reil of Adobe spoke about the overnight agent run. Martin Emde of Gusto spoke about the balance between speed and control. Evan Magnussen of Garner Health spoke about the standardized SDLC and the weight off employees' shoulders.
The article does not mention the notes, spec, or any internal document. It presents the information as a finished news piece, with the announcement as the lede and the supporting data organized under clear headings. The structure moves from the announcement to the reasoning, then to the testing data, the red-teaming results, the rollout details, and the customer stories.
The final section, "Related on Neura Market," will include links to relevant areas. The article will end with that section, as required.