Anthropic is making auto mode the default in Claude Code to address permission fatigue among users, boosting safety with layered controls and enhanced threat detection, while maintaining human oversight for critical operations.
Anthropic is making auto mode the default in Claude Code for Pro, Max and Team users from August 14, a change intended to cut down on the constant stream of approval prompts that can slow agentic coding workflows. Enterprise and API customers will keep the feature optional for now, although Anthropic says a wider rollout is planned across AWS, Google Cloud and Microsoft Foundry deployments in the coming month. According to Anthropic’s engineering post and its documentation, auto mode does not mean unrestricted access: a classifier still examines each tool call and blocks actions that are irreversible, destructive or outside the user’s environment.
The significance of the change lies less in the product switch than in the evidence Anthropic used to support it. In a controlled study involving 1,053 paid professional testers working in a sandboxed setting, participants were asked to approve routine actions until, mid-session, a dangerous command was substituted without their knowledge. Anthropic says human reviewers identified the threat 13.6% of the time, while the classifier in auto mode stopped it 89% of the time. The gap widened as sessions went on: human detection fell sharply after repeated prompts, while the classifier’s performance stayed steady.
Anthropic’s telemetry suggests the broader problem is permission fatigue. The company says that by June 2026 about half of active CLI users had created a broad Bash allow rule, 62% had used bypassPermissions or dismissed prompts at some point and a quarter of interactive sessions began in bypass mode by default. In other words, many users were already finding ways to avoid the friction of repeated approvals, which weakens the idea that manual prompts alone provide meaningful protection at scale.
The design of auto mode is more layered than a simple yes-or-no filter. Anthropic says it applies hard denials to data exfiltration, checks live repository state before allowing potentially destructive git operations and treats the same git push differently depending on whether the destination is private, trusted or public. It also ignores broad allow rules that would otherwise let arbitrary commands skip review, restoring them only when users leave auto mode. That approach resembles a policy engine built around a deterministic safety layer rather than a single probabilistic decision.
Security testing also appears to have shaped the rollout. Anthropic says it commissioned Trajectory Labs to run 72 indirect prompt-injection scenarios against Claude Code and OpenAI Codex using the same browser-automation harness. In that test, Claude Code running auto mode recorded no successful attacks across 720 attempts, while Codex’s Auto-review mode showed a 5.83% success rate and Full Access mode 19%. Anthropic also says it worked with Apollo Research in a separate red-team exercise, and after tuning the classifier against one attack set it improved on a held-out set, though at a small cost in missed catches elsewhere.
Even so, Anthropic stops short of presenting auto mode as a replacement for human judgement. Its own guidance says the feature reduces risk but does not remove it, and recommends manual review for production infrastructure changes, cloud identity and access management, and any session touching a live customer environment. For teams deciding whether to adopt it, the practical question is not whether permissions matter, but whether a human prompt still adds value once review fatigue and approval bias set in.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
