Claude Code makes auto mode the default, swapping approval prompts for a classifier

Starting August 14, 2026, Anthropic will flip new Claude Code sessions on Pro, Max, and Team plans into “auto mode,” which drops per-command approval prompts in favor of a classifier that screens every tool call and blocks actions that are irreversible, destructive, or reach outside the user’s environment. When it blocks something, Claude tries a safer route or asks directly; after three blocks in a row or twenty in a session it falls back to manual approvals. Existing permission allow-rules still run ahead of the classifier, except broad ones that grant arbitrary code execution (like Bash(python:*)), which are suspended in auto mode so commands can’t skip screening. The classifier’s per-call token overhead is now free on these plans, while Enterprise, the API, and cloud-partner platforms stay opt-in for roughly another month.

The safety case rests on evidence that developers rubber-stamp approvals: 97% of permission prompts get approved and only 3% rejected, versus a 39% rejection rate when Claude presents a full plan. In a blind study of 1,053 paid testers, a routine prompt was swapped for an obviously dangerous command—testers caught it just 13.6% of the time while auto mode blocked 89%, and human vigilance decayed over longer sessions (about 17% down to 5%) while the classifier stayed flat. A review of flagged production sessions found manual-approval runs contained serious unintended harm more than twice as often as auto mode (6.3% vs. 2.4% at production-level severity). A two-week engagement with Apollo Research on injection and exfiltration attacks fed a find-fix-verify loop that hardened the classifier further.

The significance is a real shift in the agent security model—from human-in-the-loop approval to automated gating—justified by the claim that habitual clicking makes humans an unreliable checkpoint. It also enables longer unattended runs, making hours-long tasks with models like Claude Opus 5 more practical; Anthropic says auto-mode users at Teams and Enterprise ship about 25% more PRs, with Adobe, Nuro, Gusto, and Garner Health already running it in production. The trade-off worth watching: users who leaned on broad allow-rules or bypass modes get routed through a classifier they can’t inspect, and the safety claims lean heavily on Anthropic’s own and commissioned evaluations.