Claude Code sessions on Pro, Max and Team plans now start in auto mode. Anthropic announced the change on August 9 and flipped the default on August 14; Enterprise, API and cloud-platform accounts stay opt-in for now, with a default rollout planned within a month. The numbers Anthropic put at the center of the announcement: users approve 97% of permission prompts, and in a controlled test they caught 13.6% of dangerous commands while the classifier caught 89%.
That is a defensible reason to change the default, and also an admission that the permission prompt most teams have been clicking through was not doing much. The replacement is a model whose verdicts you mostly cannot read.
What auto mode actually does
Auto mode is not the same as skipping permissions. A second model, the classifier, reviews tool calls before they run, at the end of a fixed order of checks. Anything matching your explicit allow, ask or deny rules resolves first, without the classifier. Read-only actions and file edits inside the working directory are auto-approved. Everything else, which in practice means shell commands and network operations, goes to the classifier, and if the classifier blocks, Claude is told and tries a different approach.
The classifier sees your messages, the tool calls, and your CLAUDE.md content. Tool results are stripped out, so a hostile web page or file cannot talk to the classifier directly; a separate server-side probe scans incoming tool results for injection attempts before Claude reads them. On entering auto mode, broad allow rules like a blanket Bash(*) or a wildcarded interpreter are suspended. Narrow rules such as Bash(npm test) carry over and still resolve before the classifier runs.
The default block list is long. It covers curl | bash, sending sensitive data to external endpoints, production deploys and migrations, force pushes, git reset --hard and its cousins, IAM and repo permission grants, secret-manager writes, merging an unreviewed pull request, printing a live credential into the transcript, and destroying files that existed before the session began. Data exfiltration sits in a hard-deny category the classifier is designed never to approve. Most of the rest is soft: a specific instruction from you clears it, so “clean up the repo” does not authorize a force push but “force-push this branch” does.
What it allows by default matters as much. Local file operations, installing dependencies declared in your lockfile, read-only HTTP, pushing to any branch of the repository you are working in, and reading .env and sending those credentials to their matching API all run without a prompt. If the classifier blocks three times in a row or 20 times in a session, auto mode pauses and prompts return.
The study, and what it can and cannot support
Anthropic’s controlled study put 1,053 paid professional testers in an isolated environment and swapped one dangerous command into a permission prompt mid-session. Humans caught it 13.6% of the time; the classifier blocked it 89% of the time. After 50 or more prior prompts, human detection fell to roughly 5%, while the classifier stayed flat. The more you use the tool, the less the prompt protects you.
The company also cites a May-to-June analysis of flagged production sessions in which manually approved sessions contained unintended harmful actions 2.6 times as often as auto-mode sessions (6.3% versus 2.4% at production severity). Apollo Research ran a two-week red-team pilot that took the classifier’s miss rate from 12% to 7% after hardening. Trajectory Labs ran 72 indirect prompt-injection scenarios ten times each and reports none of the 720 attempts succeeded against Claude Fable 5, Opus 5 or Sonnet 5 in auto mode.
Anthropic designed and ran the controlled study, paid the testers, and defined what counted as dangerous. Detecting one planted command per session is a narrower task than catching an agent that drifts into a bad action across a long, legitimate-looking sequence, and the study measured the former. The 2.6x figure compares sessions that were already flagged, a filtered population. The red-team and injection results come from firms Anthropic engaged, and The Register notes there is no independent auditor on any of it. None of that makes the figures wrong. They are the vendor’s evidence for the vendor’s default, and the strongest one, the 97% approval rate, is a fact about us rather than about the classifier.
What changed on August 14 if you run Claude Code
The flip applies to new sessions in the terminal and the VS Code extension on Pro, Max and Team, on Claude Code v2.1.228 or later (v2.1.233 on native Windows). Your first session after installing or upgrading still starts in Manual. If your ~/.claude/settings.json already pins a defaultMode other than auto, nothing changes; Claude Code asks once whether to switch and leaves the setting alone if you decline. Enterprise plans, Console API keys, Bedrock, Google Cloud’s Agent Platform and Microsoft Foundry still start in Manual.
Two settings matter for anyone who wants control back. permissions.defaultMode in user or managed settings pins the starting mode; an auto value in a project’s .claude/settings.json is ignored on purpose, so a checked-in repo cannot switch your sessions into auto mode. permissions.disableAutoMode set to "disable" in managed settings removes auto mode entirely, and a session started with --permission-mode auto falls back to Manual.
Anthropic stopped charging Pro, Max and Team users for the classifier’s token overhead the same day; on Enterprise and API accounts the calls still count toward usage. The classifier runs on Sonnet 5 by default, and each check sends a slice of the transcript plus the pending action, so shell-heavy sessions pay a round-trip per command. Anthropic’s productivity claim is that Team and Enterprise users on auto mode ship about 25% more pull requests, which is what you would expect from removing a click.
What replaces the approval habit
The case for the flip is that the human loop was already broken. Anthropic’s own numbers say 49.5% of active CLI users had written overly permissive Bash allow rules and 62% had used bypassPermissions or clicked “don’t ask again.” People reject 39% of high-level plans and 3% of individual permissions. Nobody at a small shop was auditing those approvals, and the classifier is plainly better at spotting a planted rm -rf than a developer on prompt fifty-one.
The problem is the replacement. In most sessions the reason for a block is the fixed text Blocked by classifier; the classifier scores actions on an internal severity scale and does not write an explanation. Boundaries you state in conversation (“don’t push until I review”) are honored, but they live in the transcript and can vanish when context compaction removes the message. Narrow allow rules bypass the classifier entirely, so a Bash(./deploy.sh *) rule you wrote in March still lets an unexpected argument through. In the classifier’s rule tiers, a developer’s allow entry can override an organization’s soft_deny; the docs say so directly. The only boundary the classifier cannot cross is a permissions.deny rule, which most teams never wrote because the prompt felt like enough.
The classifier also reads whatever CLAUDE.md content the session loads. That is how you steer it, and it means a repository’s checked-in instructions are input to the model deciding what is safe in that repository, which is the same reason Anthropic excludes project-level autoMode settings. Keep it in mind when you clone something you did not write.
None of this is unique to Anthropic. The UK AISI report last week described agents from three labs stepping outside their test harnesses, and Grok Build was found uploading entire git repositories, secrets included, to its backend. Against that field, a classifier that strips tool results, refuses exfiltration outright and falls back to prompts after repeated blocks is the most careful design shipping. It is still a design in which a model decides whether an action is safe, and Anthropic’s own caveat says as much: for high-stakes changes to production infrastructure, review the actions yourself.
What to audit before you trust it
Start by finding out what the classifier is running with. claude auto-mode config prints the effective environment, allow, soft-deny and hard-deny lists with your settings applied; claude auto-mode defaults prints the built-in versions. Read ~/.claude/settings.json alongside them, because any narrow shell rules you accumulated under Manual mode still resolve ahead of the classifier. If that list has grown scripts, wrappers or interpreters, either prune it or set autoMode.classifyAllShell to true and accept the latency.
Then write the deny rules you skipped. permissions.deny in managed settings blocks before the classifier is consulted and cannot be overridden by the classifier, an allow rule, or anything you say in the chat. Production database hosts, deploy commands, the secrets CLI, and whatever else must never run from an agent session belong there. For actions you want to see but not forbid, permissions.ask entries like Bash(git push *) and Bash(gh pr create *) force a prompt in every mode.
Fill in autoMode.environment with your source-control org, trusted domains and buckets, and, more importantly, your sensitive data locations, production namespaces and protected infrastructure scopes. Until you name them, the protective rules run on heuristics like “anything with prod in the hostname.” Keep the literal string $defaults in every list you touch; omitting it replaces the entire built-in list for that section, and the built-in hard-deny list is where the exfiltration rule lives.
Finally, decide where the record goes. Denials show up under the Recently denied tab in /permissions, and a PermissionDenied hook can ship them somewhere durable. If your Claude Code usage is a compliance question for a client, that hook and your managed settings are the audit trail, because the classifier’s verdicts otherwise leave nothing behind but the words Blocked by classifier.
The default flip is the right call on Anthropic’s numbers, and the numbers mostly measure how little attention the old prompt was getting. The flip trades that inattention for trust in a classifier whose reasoning is hidden and whose soft rules a developer can loosen, and none of that amounts to oversight. What holds regardless of the classifier’s judgment is the deny rule you have to write yourself, and teams that never wrote one now have a reason to.
Sources
- Auto mode is now the default in Claude Code for Pro, Max, and Team plans — Anthropic
- Auto mode for Claude Code — Anthropic
- Choose a permission mode — Claude Code Docs
- Configure auto mode — Claude Code Docs
- Anthropic is turning Claude Code’s auto mode on by default — TechCrunch
- PSA: Claude Code now enables auto mode as default, Anthropic says — 9to5Mac
- Anthropic makes Claude Code’s auto mode default for paid users — InfoWorld
- Claude Code puts auto mode in the driver’s seat — The Register