Anthropic Makes Claude Code Auto Mode Default for Pro, Max, and Team Users

Quick Facts

• Auto mode becomes the default for Claude Code Pro, Max, and Team accounts on August 14, 2026, with Enterprise and API users following in September.
• Internal testing showed auto mode caught 89% of dangerous commands versus 13.6% for human reviewers, who approved 97% of all prompts reflexively.
• Independent evaluator Trajectory Labs ran 720 prompt injection attacks against Claude models in auto mode and recorded zero successful breaches.

Anthropic will switch Claude Code’s default permission mode from manual approval to auto mode on August 14, 2026, for users on Pro, Max, and Team plans. The company announced the change on August 7, citing internal data showing automated checks outperform human reviewers by a wide margin.

Auto mode sits between two existing options: a sandbox that isolates tool calls and the --dangerously-skip-permissions flag that removes all approval checks. Instead of prompting users at each step, auto mode runs a classifier that blocks actions deemed irreversible, destructive, or directed outside the user’s environment.

The Case Against Human Review

Anthropic’s internal study of 1,053 paid users found that humans blocked just 13.6% of deliberately planted dangerous commands. Auto mode stopped 89% of the same commands. The gap comes down to approval fatigue: users approved 97% of all prompts, and their block rate dropped from roughly 17% early in a session to about 5% after seeing 50 or more prompts.

Across the full study, auto mode blocked 800 commands that human testers approved. Humans blocked only six commands that auto mode allowed. Anthropic concluded that an imperfect classifier still outperforms a developer conditioned by repetition to click approve.

Real-world session data supports the finding. Between May and June, 6.3% of sessions using manual approval contained a harmful action at production-level severity or higher that the user had not requested. For auto mode sessions, the figure was 2.4%.

Third-Party Security Audit

Anthropic hired Trajectory Labs to independently test Claude Code’s auto mode. The firm designed 72 indirect prompt injection scenarios withheld from Anthropic’s own training and testing data, then ran each scenario 10 times for 720 total attack attempts against Claude Fable 5, Opus 5, and Sonnet 5. None succeeded.

For comparison, Trajectory Labs tested GPT-5.6 Sol under OpenAI’s Codex. It recorded a 5.83% attack success rate under Auto-review mode and as high as 19.03% under Full Access mode. Prompt injection, where malicious instructions are embedded in text, code, or files that an AI agent later processes, has been identified repeatedly as a central weakness in AI coding tools.

How the System Handles Blocks

When auto mode blocks a command, Claude attempts a safer alternative or requests explicit authorization. In interactive sessions, three consecutive blocks or 20 total blocks trigger a switch to manual approval. In headless mode using claude -p, the process terminates instead. Hard denies cover data exfiltration, secrets handling, git push destination checks, and prompt injection attempts.

Anthropic disclosed two internal incidents where auto mode prevented real harm. In one case, it stopped Claude from uploading confidential data to a public page. In another, it terminated roughly 2,000 processes that would have disrupted active GPU training jobs.

Rollout and Pricing

Enterprise and API users, including those on AWS Amazon Bedrock, Google Cloud’s Agent Platform, and Microsoft Foundry, will receive the update in September or later. Anthropic said it is coordinating timing with its cloud partners.

Anthropic is also dropping the token surcharge previously applied to auto mode classifier calls, which the company described as a small number of extra tokens per tool call. Users with an existing permission mode set will receive a one-time in-app notification and can revert with Shift+Tab.

Boris Cherny, Head of Claude Code, wrote on X that his team had been using auto mode exclusively for several months. “I couldn’t imagine going back to permission prompts,” Cherny said.

Read more: Anthropic is turning Claude Code’s auto mode on by default