Starting August 14, Anthropic is making Auto Mode the default for Claude Code users with a Pro, Max, or Team subscription. As a result, the AI coding agent will need to ask for permission less often before performing actions. According to Anthropic, this is not only more efficient but also safer: developers often automatically approve warnings.
Auto mode has been available as a beta since March. Instead of asking for permission for every potentially sensitive action, a separate classifier assesses what Claude Code intends to do. It is designed to intervene in cases such as destructive or irreversible actions, or actions outside the environment in which Claude operates. Claude then tries to find a safer alternative or, after all, requests permission. For Enterprise, the Claude API, and various cloud platforms, Auto Mode remains optional for now. Anthropic plans to make the feature standard there as well in the coming month.
People click away warnings
The most striking justification for the change comes from research on human oversight. Claude Code users approve 97 percent of permission requests. Anthropic suspects that, over time, many users barely assess what exactly they’re giving permission for.
This was also evident in an experiment involving 1,053 paid professional testers. During a test session, a normal permission request was replaced with a clearly dangerous command. Only 13.6 percent of the participants blocked it. Auto mode blocked 89 percent of the same commands.
As the session lasted longer, human vigilance continued to decline. At the beginning, approximately 17 percent of the dangerous commands were blocked; after fifty previous permission requests, this figure dropped to about 5 percent. According to Anthropic, Auto Mode’s performance remained consistent.
Prompt injections tested
Anthropic also had Trajectory Labs test 72 indirect prompt-injection scenarios, every ten times. None of the 720 attacks succeeded against Claude Fable 5, Opus 5, or Sonnet 5 with Auto Mode. With GPT-5.6 Sol in Codex Auto-review, 5.83 percent of the attacks succeeded, and with Full Access, 19.03 percent succeeded.
An important caveat applies here. The same external browser integration was used for both systems. OpenAI’s and Anthropic’s proprietary browser security measures were not part of the test. As a result, the figures primarily reflect the performance of the tested models and configurations, not the overall security of both products.
Additional security layer
Since its introduction, Anthropic has further secured Auto Mode. For example, there are “hard deny” rules for actions that must never be automatically approved, including certain forms of data exfiltration. External content from sources such as web pages, files, and tool outputs is also checked for potential prompt injections.
At the same time, this is intended to give Claude more leeway to work independently for longer periods. Anthropic cites three internal incidents in which Auto Mode already intervened. Among other things, after a failed internal upload, Claude attempted to send information to a public code site, and during another session, it tried to terminate processes on approximately 2,000 pods, which could have affected hundreds of GPUs running training tasks.
According to Anthropic, users of auto mode in Teams and Enterprise submit approximately 25% more pull requests. Companies including Adobe, Nuro, Gusto, and Garner Health are already using the mode as the default. Nevertheless, for significant changes to production environments, Anthropic continues to recommend manually verifying Claude’s actions.