Anthropic is done asking Claude Code users to click “approve” every few minutes. Starting August 14, 2026, Claude Code auto mode becomes the default setting for new sessions across the Pro, Max, and Team plans, replacing the constant stream of permission prompts that have long defined how developers interact with AI coding agents. The company says it has the data to back the switch, but independent commentary — including from developer and researcher Simon Willison — suggests the story is more nuanced than a simple safety win.
Summary
Key takeaways
- Anthropic makes auto mode the default for Claude Code Pro, Max, and Team plans beginning August 14, 2026.
- In a test of 1,053 paid users, auto mode blocked 89% of dangerous commands, while human testers refused only 13.6% of the time.
- Independent evaluator Trajectory Labs ran 720 indirect prompt injection attacks against Claude Fable 5, Opus 5, and Sonnet 5 running auto mode — none succeeded.
- Anthropic will stop charging for the extra tokens the auto mode classifier uses per tool call.
- Analysts still flag unresolved risks, including malicious third-party packages that could exfiltrate data undetected.
Anthropic makes Claude Code auto mode the default
The shift answers a problem Anthropic engineers have talked about openly: confirmation fatigue. Asking a human to approve every step of an AI agent’s workflow sounds cautious, but in practice it trains people to click through prompts without really reading them. According to Anthropic, auto mode swaps that repetitive approval loop for a classifier that inspects each tool call for actions that are irreversible, destructive, or clearly out of bounds. If the classifier flags something, Claude either looks for a safer path or falls back to asking for permission — and if blocks keep piling up, the whole session reverts to manual approval.
The rollout affects Pro, Max, and Team plans unless a user or administrator has manually pinned a different permission setting. Anthropic is also removing a small financial friction point: it will no longer charge for the extra tokens the classifier consumes on each tool call, according to the company’s own blog post on the change.
Why does this matter beyond convenience? Anthropic says auto mode is already changing how teams work — Team and Enterprise customers using it reportedly ship about 25% more pull requests than those relying on manual approval. That’s a meaningful productivity signal, but it also raises the stakes: more autonomous coding activity means more opportunities for something to go wrong if the safety layer underneath isn’t solid.
Does auto mode actually block more dangerous commands than humans do?
Yes, according to Anthropic’s own testing — by a wide margin. The company ran a study across 1,053 paid testers in which, partway through a normal session, a routine permission prompt was quietly swapped for a clearly dangerous command. Every tester saw the identical scenario. The result: only 13.6% of humans refused the harmful action. Auto mode, tested against the same command, blocked it 89% of the time.
The gap widens the longer a session runs. Anthropic reported that human vigilance dropped to roughly 5% after 50 prompts — a number that illustrates exactly why the company frames confirmation fatigue as a real safety liability rather than an abstract concern. People get tired, distracted, or complacent. A classifier, at least in theory, doesn’t.
Still, the math cuts both ways. That 89% block rate leaves 11% of dangerous commands slipping through auto mode’s checks — a gap Anthropic itself acknowledges. The company continues to recommend human review for changes touching production systems, which suggests even Anthropic isn’t ready to call auto mode a complete substitute for human judgment.
Prompt injection: the bigger test for AI coding agents security
Blocking an obviously dangerous command is one thing. Stopping an attack hidden inside content the agent reads from elsewhere is another problem entirely, and it’s the one that worries security researchers most. Prompt injection — sneaking malicious instructions into text, code, or files that an AI agent later consumes — has been flagged repeatedly as a central weakness in AI coding agents security, and Simon Willison has previously predicted 2026 could bring a serious security incident tied to exactly this kind of vulnerability.
Anthropic’s answer was to commission an outside check. The company hired Trajectory Labs to independently evaluate the latest publicly available versions of Claude Code and Codex as of July 17, 2026. Trajectory Labs designed 72 indirect prompt injection scenarios that had been held out from Anthropic’s own training and testing, then ran each scenario ten times — 720 attack attempts in total. According to the results Anthropic published, none of the 720 attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 while running auto mode.
That’s a striking result, and it’s the headline Anthropic wants people to take away. Thariq Shihipar, one of the Anthropic representatives who discussed the work at a recent Fireside Chat, joked on social media that the report could have been titled “defeating the lethal trifecta” — a reference to the combination of untrusted input, sensitive data, and agent autonomy that security researchers consider the most dangerous setup for AI systems. Cat Wu, another Anthropic representative present at that discussion, said the company has “pretty much mitigated every attack” it tested against.
Willison, for his part, remains cautiously skeptical rather than convinced. He notes that a zero-success rate against 720 curated attack attempts is encouraging, but it isn’t the same as proof against every attack vector a real-world adversary might try. One scenario he specifically raises: a malicious third-party software package that instructs a coding agent to fetch and run additional files before executing legitimate commands — files that could quietly exfiltrate data in the process. It’s unclear whether any version of Claude Code auto mode would catch that kind of indirect, supply-chain-style attack, since the malicious instruction wouldn’t necessarily look like a dangerous command in the way the classifier is designed to detect.
What’s still unresolved
Two distinct safety problems sit underneath this whole conversation, and auto mode doesn’t necessarily solve both equally well. The first is accidental harm — an agent deleting the wrong files or wiping a production database simply because it misunderstood an instruction. The second, and the one that concerns security researchers more, is deliberate prompt injection, where an attacker weaponizes content the agent trusts.
Willison’s own conclusion leans toward a more structural fix than trusting any single safety layer, however well it performs in testing. Rather than relying entirely on Anthropic AI safety mechanisms baked into the model or classifier, he says he’s now more motivated to design agent workflows that simply don’t give AI systems access to data or tools capable of causing damage if triggered incorrectly. That’s a meaningfully different posture than “trust the classifier” — it treats auto mode as one layer of defense among several, not a finished solution.
It’s also worth noting that Anthropic isn’t the only major AI lab wrestling with this trade-off. OpenAI reportedly opted out of enabling an equivalent auto mode by default for its most capable GPT-5.6 model, choosing a more conservative approval-based approach instead — a sign that even within the industry, there’s no consensus yet on how much autonomy is safe to hand an AI coding agent by default.
FAQ
What is Anthropic’s auto mode in Claude Code?
Auto mode is a setting that replaces repeated human approval prompts with a classifier designed to automatically block irreversible or dangerous tool calls, only falling back to manual approval when blocks repeat or a truly ambiguous action comes up.
How effective is auto mode at blocking dangerous commands compared to humans?
In testing with 1,053 paid users, auto mode blocked 89% of dangerous commands, while only 13.6% of human testers refused the same harmful action — and human vigilance reportedly dropped further, to around 5%, after 50 prompts in a session.
Does auto mode prevent prompt injection attacks completely?
Independent testing by Trajectory Labs found no successful prompt injection attacks among 720 attempts against Claude Fable 5, Opus 5, and Sonnet 5 running auto mode. That said, risks like malicious third-party packages that exfiltrate data may not be fully addressed by the current system.
What safety risks still exist with AI coding agents despite auto mode?
Agents can still perform damaging actions by accident, and sophisticated attacks — particularly ones routed through malicious third-party code packages — may not be reliably caught by auto mode’s classifier, according to analysis of Anthropic’s published results.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
