AIArticle Anthropic's data on rubber-stamped approvals justifies the auto mode default — but the sandbox is still your job.
Mariana Souza Anthropic's own telemetry says Claude Code users approve 97% of permission prompts. In a controlled study of 1,053 paid developers, when a genuinely dangerous command was slipped into a session, only 13.6% of humans rejected it — and the catch rate dropped to around 5% once a session passed fifty prompts. The permission dialog, the thing that was supposed to keep an agent honest, turned out to be a ritual. Starting August 14, Anthropic is acting on that data: auto mode becomes the default for new Claude Code sessions on Pro, Max, and Team plans.
This is the most consequential default change any agentic coding tool has shipped, and the uncomfortable part is that the reasoning holds up.
What actually changes #
Auto mode isn't --dangerously-skip-permissions
with better branding. Instead of asking you before each action, Claude Code routes every tool call through a separate trained classifier that screens for three things: irreversible actions, destructive actions, and anything aimed outside your environment. In the same study where humans caught 13.6% of planted dangerous commands, the classifier caught 89%. Anthropic also reports production numbers: 6.3% of manually approved sessions contained unintended harmful actions at production-level severity, versus 2.4% under auto mode. Read that again — the mode with a human in the loop was worse.
The mechanics matter for anyone running this daily. When the classifier blocks something, Claude tries a safer route or falls back to asking you explicitly. Three consecutive blocks, or twenty in a session, and the whole session drops back to manual approval. Data-exfiltration actions are hard-denied — you can't even approve them in auto mode — and destructive git operations get a repository-state check first. Anthropic is eating the classifier's token cost on paid plans, which removes the obvious objection that you're paying for your own guardrails.
Scope is narrower than some of the coverage suggests. Enterprise and API users stay opt-in for roughly another month, and Claude Code on AWS, Google Cloud, and Microsoft Foundry remains opt-in for now — despite at least one widely shared blog post claiming the cloud platforms flipped first. They didn't. If your compliance team is panicking about Bedrock, they can stand down until the follow-up rollout.
The prompt was always theater #
None of this should surprise anyone who lived through browser SSL warnings or Windows Vista's UAC. Habituation is one of the oldest findings in security UX: put a confirmation dialog in front of people often enough and it stops being a decision and becomes a reflex. Claude Code sessions can generate dozens of prompts an hour. Nobody reads the forty-third Bash(npm test)
approval. The community quietly admitted this ages ago — the Hacker News thread on the announcement is full of people who've run --dangerously-skip-permissions
for months, relying on Docker containers and git rather than dialogs. Boris Cherny, who leads Claude Code, told TechCrunch his team has used auto mode exclusively for months. So Anthropic isn't removing a working safeguard. It's replacing a failed one with something that at least pays attention. That's the honest framing, and it's also where you should stop nodding along.
89% is a seatbelt, not a boundary #
An 89% catch rate means an 11% miss rate, and misses compound over thousands of tool calls. Anthropic commissioned third-party testing of 720 indirect prompt-injection attempts across 72 scenarios and reports zero successes against its latest models in auto mode — a genuinely strong result — but Simon Willison's skepticism is the right posture: a fixed test suite tells you about the attacks someone thought of, not the malicious npm package published next Tuesday whose install script reads like documentation. Classifiers are probabilistic. Security boundaries shouldn't be.
The HN consensus got this right: the real boundary is OS-level isolation, and that doesn't change on August 14. If your agent runs in a dev container or a VM with scoped credentials and no production access, an 89% classifier on top is defense in depth. If it runs in your main shell with your AWS keys in the environment, that same classifier is now the only thing between a prompt injection and your infrastructure — and 11% of the time, per Anthropic's own numbers, it blinks.
There's also a design question Anthropic has skated past. Cursor's approach — let users allowlist specific commands once, then stop asking — attacks prompt fatigue without ceding judgment to a model. Claude Code has allowlists too, in settings.json
, but the default is now "trust the classifier" rather than "trust your own curated list." For solo developers that trade is probably fine. For teams, it moves a policy decision from configuration into a model's weights.
What to do before the 14th #
Existing sessions and pinned defaults don't change, but new sessions will, so decide deliberately:
If you want the old behavior, setdefaultMode
in your settings, or toggle per-session with Shift+Tab. Org admins can enforce a mode — or kill auto mode entirely withdisableAutoMode
— through managed settings.If you're adopting auto mode, sandbox first. Dev containers, a VM, or at minimum a dedicated user account with no cloud credentials. Treat the classifier as the last line, not the first.Configure hard-deny rules for anything touching secrets, deploy targets, or customer data. The exfiltration denies are built in; your production endpoints aren't.If you're on Enterprise or a cloud platform, you have about a month. Use it to set the managed default before Anthropic sets it for you.
The verdict: this is a genuine shift, not hype, and it's directionally correct — the data on human review is too damning to defend the prompt. Expect GitHub Copilot's agent mode and Cursor to follow within a quarter, because "the default assistant doesn't nag" is now table stakes. But the burden of safety just moved from a dialog box you ignored to an environment you have to actually architect. Anthropic did its part with the classifier. The sandbox is still on you.
Sources & further reading #
Auto mode is now the default in Claude Code— claude.com - Auto mode is now the default in Claude Code for Pro, Max, and Team plans— simonwillison.net -
[Anthropic is turning Claude Code's auto mode on by default](https://techcrunch.com/2026/08/09/anthropic-is-turning-claude-codes-auto-mode-on-by-default/)— techcrunch.com -
[Auto Mode will soon be the default in Claude Code](https://thenewstack.io/claude-code-auto-mode/)— thenewstack.io -
[Auto mode is now the default in Claude Code (discussion)](https://news.ycombinator.com/item?id=49239021)— news.ycombinator.com
[Mariana Souza](https://sourcefeed.dev/u/mariana_souza)· Senior Editor
Mariana covers the fast-moving world of machine learning and generative AI, with a particular focus on how these technologies are reshaping development workflows. When she isn't stress-testing the latest foundation models, she's usually at a local hackathon.
Discussion 0 #
No comments yet
Be the first to weigh in.