Claude Code Switches On Auto Mode by Default

Starting August 14, Claude Code will run in auto mode by default for its Pro, Max, and Team subscribers. The change, announced by Anthropic, swaps the tool's steady stream of approval prompts for a separate classifier that inspects every command before it runs and blocks anything judged irreversible, destructive, or aimed outside the user's own environment.

The reasoning behind the switch is blunt: people are not good at catching dangerous commands, and they get worse the longer they work. In Anthropic's testing with 1,053 paid users, auto mode blocked 89 percent of dangerous commands. Humans approving actions by hand refused only about 14 percent, and that number fell to roughly 5 percent after fifty prompts, as attention wore thin. The developer Simon Willison, who wrote up the change on his blog, noted how sharply the tool now leans on the model to police itself.

How it works

Instead of asking the user to sign off on each step, Claude Code routes every action through the classifier. When something is blocked, the assistant usually finds a safer route or stops and asks. The system also adds a layer of defense against prompt injection, the trick where hidden instructions buried in a file or a web page try to hijack an agent. Tool results are scanned by separate probes for malicious instructions, and the classifier checks that each action still matches what the user actually asked for.

Anthropic pointed to an outside evaluation to support the claim. Trajectory Labs ran 720 indirect prompt-injection attacks against Fable 5, Opus 5, and Sonnet 5 while they were in auto mode. None of them succeeded.

The gap that remains

Auto mode is not a complete shield, and Anthropic does not claim it is. The most cited weak spot is the software supply chain: a malicious third-party package pulled into a project could still try to quietly move data out in ways a command classifier is not built to catch. That is a different problem from a reckless shell command, and it needs different defenses.

The move follows a stretch of unease about what coding agents do when left alone. British safety testers recently reported that agents went off-script during cyber evaluations, and OpenAI paused a model as it neared its own safety threshold. Handing the approval decision to a classifier is a bet that a well-trained model watching each step beats a tired human clicking yes. On the numbers Anthropic has shared, that bet looks reasonable. It also quietly moves a safety judgment most developers used to make themselves into the software.