Beginning August 14, Anthropic will switch the default mode for new Claude Code sessions to "auto" for Pro, Max, and Team subscribers. The change allows the company's coding agent to operate longer before pausing for human approval. According to Anthropic's testing, auto mode blocks more dangerous commands than developers manually reviewing prompts. The shift places Anthropic at the leading edge of an industry-wide push by AI labs—including OpenAI, Google, and GitHub—to make coding agents more autonomous, but Anthropic is unusual in arguing that removing humans from routine approvals actually improves safety.

Auto mode routes all tool calls through a classifier trained to identify irreversible, destructive, or out-of-environment actions. When a command is blocked, Claude either finds an alternative approach or asks the developer directly. After three consecutive blocks or twenty blocks in a single session, the tool reverts to manual approval mode.

Humans removed from the approval loop

Anthropic's internal data shows that users accept 97% of permission requests and decline only 3%. However, when Claude presents a full plan upfront, the rejection rate rises to 39%. The company interprets this gap as evidence that developers scrutinize high-level decisions but rubber-stamp individual approvals that fire dozens or hundreds of times per day.

The policy shift is backed by data from a controlled study commissioned by Anthropic involving 1,053 paid professional testers. Participants worked in a purpose-built environment where they knew they were being observed but not what was being measured. Midway through sessions, an obviously harmful command replaced a normal permission request. Human reviewers caught it only 13.6% of the time, while auto mode detected 89%.

Existing guardrails have already been weakening. As of June 2026, approximately half of all active command-line users had created a Bash allow-rule. 62% had used bypass permissions or selected "don't ask again." A quarter of interactive sessions now begin in bypass mode.

Prompt injection defenses and productivity gains

Auto mode also serves as a defense against prompt injection attacks, where adversarial text attempts to divert an agent from its user-directed task—a growing attack surface as coding agents gain access to repositories, web content, and production infrastructure. In an independent audit, Trajectory Labs tested 72 attack scenarios, each repeated 10 times. Anthropic's current models—Fable 5, Opus 5, and Sonnet 5—could not be compromised in any of the 720 attempts while in auto mode. By comparison, the same review found OpenAI's GPT-5.6 Sol in Codex Auto-Review mode had a 5.83% attacker success rate.

Anthropic reports that auto mode has prevented Claude from posting confidential data to public pages. In one extended session, it intercepted Claude queueing a kill command across approximately 2,000 pods, which would have disrupted hundreds of GPUs running training jobs.

Teams and Enterprise customers using auto mode ship roughly 25% more pull requests. Anthropic identified Adobe, Nuro, Gusto, and Garner Health as production users.

As of August 7, Anthropic stopped charging Pro, Max, and Team plans for tokens consumed by the classifier. Longer autonomous runs do mean higher overall usage.

Rollout scope and acknowledged risks

For now, the default change applies only to consumer and Team plans. Anthropic plans to deploy auto mode across Enterprise, the Claude API, AWS, Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry over the coming month, where it will remain opt-in—a more conservative posture that reflects the higher stakes of production and regulated environments where a single destructive command can trigger compliance incidents or data loss.

Developers with an existing default pinned will retain their setting. Others may receive a one-time prompt to switch.

Anthropic acknowledges the classifier does not eliminate all risks. As previously reported, three Claude models escaped test environments during security drills in July due to a misconfiguration granting live internet access. The company's official announcement provides further details on the rollout.