Claude Code Goes Auto by Default. You Were Catching 14%.

TL;DR

On August 7, Anthropic announced that auto mode becomes the default permission setting in Claude Code on August 14 for Pro, Max, and Team plans. Instead of prompting you before each tool call, a separate classifier screens every risky action for anything irreversible, destructive, or aimed outside your environment. Anthropic's case for the switch is a study of 1,053 paid testers in which people caught a planted dangerous command 13.6% of the time and auto mode caught 89%. The classifier's token overhead is also now free on those three plans. Enterprise, the API, Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry stay opt-in for now.

The number Anthropic is leading with

The headline finding is not that auto mode is good. It is that the thing it replaces was never working. Anthropic hired 1,053 testers through a research vendor, ran them through a coding task, and planted a dangerous command in the stream of permission prompts. 143 of them stopped it.

The decay curve is the part worth staring at. Testers blocked about 17% of dangerous commands early in a session, and roughly 5% once they had already cleared 50 or more prompts. Across real usage, Anthropic says users approve 97% of permission prompts.

This is the smoke alarm that chirps every time you make toast. By the fiftieth chirp you are not evaluating smoke, you are silencing a noise, and the alarm has quietly become a button you press to make the kitchen quiet again.

Anthropic also pulled the same comparison out of real sessions rather than a lab task. At production-level severity, 6.3% of manually approved sessions contained a harmful action the user had not asked for, against 2.4% of auto mode sessions. The gap held at every severity level they tested.

How the gate actually works

The mechanism has been public since Anthropic's March engineering writeup, and it matters more now that it is the default. The transcript classifier runs on Sonnet 4.6 in two stages: a fast single-token filter tuned to be cautious, then a reasoning pass only on what the filter flags. On 10,000 samples of real internal traffic, the full pipeline posted a 0.4% false positive rate. On 52 genuine overeager actions it missed 17%, and on 1,000 synthetic exfiltration attempts it missed 5.7%.

Roughly twenty hard-deny categories sit underneath: destroying or exfiltrating data, degrading security posture (disabling logging, installing SSH keys), crossing trust boundaries, and bypassing review with direct pushes to main or production deploys. Git operations now check repository visibility first, so the classifier knows whether a push leaks to the world.

Critically, the classifier does not see everything. It evaluates shell commands, web fetches, external tool integrations, subagent spawns, and filesystem operations outside the project directory. Edits to files inside your project are not routed through it at all.

When the classifier blocks something, Claude is not simply stopped. It receives an instruction to treat the boundary in good faith and find a safer path. If it keeps hitting the wall, the session escalates: 3 consecutive denials or 20 total stops the model and hands control back to you.

The independent stress test says the door has a window

In April, researchers from HKUST and ETH Zurich published a stress-test evaluation of exactly this permission gate. They ran 253 state-changing actions across 128 prompts spanning four DevOps task families, deliberately picking scenarios where authorization is ambiguous rather than obviously malicious. The end-to-end false negative rate came in at 81.0% (95% CI 73.8% to 87.4%).

The reason is the lane in the diagram above. 36.8% of all state-changing actions fell entirely outside the classifier's scope, because the agent achieved them through file edits rather than shell commands. Restricted only to actions the classifier does evaluate, the miss rate was still 70.3%, with false positives rising to 31.9%. On artifact cleanup tasks specifically, the miss rate hit 92.9%. The classifier watches the door the agent usually walks through, and the paper's contribution is pointing at the window.

Two caveats keep this honest. The paper tested a build from April, and it predates the hardening Anthropic describes in the August post. And the two studies measure different things: production traffic is mostly benign, while the stress test is a deliberately adversarial workload with no easy calls in it. Both numbers can be true at once, which is the uncomfortable part.

What Anthropic did about the gap

The August post describes a two-week pilot with Apollo Research, injecting synthetic attacks into real coding trajectories across three datasets covering broad failures, data exfiltration, and safety-related threats. Apollo handed over the successful attacks, Anthropic hardened the classifier mainly by giving it more environmental context (repository visibility, git state, data-handling rules), and afterward it caught roughly half the attacks it previously missed, at the cost of missing about 2% it previously caught. Anthropic could not tune against the held-out set, which is the argument that the hardening generalizes. A separate commissioned evaluation from Trajectory Labs ran 72 held-out indirect prompt injection scenarios, ten times each, against current Claude Code and Codex builds as of July 17.

What you should actually do before August 14

If you have never touched permission modes, your sessions change behavior next Friday. The controls are unremarkable and worth knowing anyway.

• Switching modes: Shift+Tab in the CLI, or the mode dropdown in the desktop app.
• Pinning a default for a fleet: set defaultMode in managed settings, or turn the feature off entirely with disableAutoMode.
• If you are on Enterprise or the API: nothing changes yet. Auto mode stays opt-in during the transition, with rollout planned within a month.
• If you run agents against production: Anthropic's own guidance is that for high-stakes changes to production infrastructure you should still review the actions yourself. A 0.4% false positive rate is a usability number, not a safety guarantee.

The uncomfortable conclusion is that the argument for auto mode does not depend on the classifier being excellent. It depends on the alternative being 5% after fifty prompts. That is a real improvement and a low bar in the same sentence, and it is worth being clear-eyed that a gate with a documented file-edit blind spot is now the thing standing between an overeager agent and your repo.

Key Takeaways

• Auto mode becomes the default permission mode in Claude Code on August 14 for Pro, Max, and Team. Enterprise and API stay opt-in for now.
• Anthropic's 1,053-tester study: humans caught a planted dangerous command 13.6% of the time, auto mode 89%. Human detection falls to about 5% after 50 prior prompts.
• In real sessions, 6.3% of manually approved runs contained unrequested harmful actions at production severity, versus 2.4% under auto mode.
• The classifier is a two-stage Sonnet 4.6 pipeline with a 0.4% false positive rate on real traffic, and it escalates to you after 3 consecutive or 20 total denials.
• An independent HKUST and ETH Zurich stress test measured an 81.0% end-to-end miss rate on ambiguous DevOps tasks, largely because 36.8% of state-changing actions arrive as in-project file edits the classifier never evaluates.
• Classifier token overhead is no longer billed on Pro, Max, and Team, effective August 7.

Sources: Anthropic, "Auto mode is now the default in Claude Code for Pro, Max, and Team plans", Anthropic Engineering, "How we built Claude Code auto mode", Ji et al., "Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code's Auto Mode" (arXiv:2604.04978), 9to5Mac