Claude Code auto mode becomes the default on 14 August 2026 for Pro, Max, and Team plans
Anthropic's AI classifier replaces per-action approval prompts in Claude Code, catching 89% of dangerous commands vs 13.6% for human reviewers.
If you use Claude Code on a Pro, Max, or Team plan, the way it asks for permission is about to change. From 14 August 2026, every new session will start in auto mode by default. Instead of prompting you to approve each file write or bash command, Claude Code will proceed on its own and only stop when an action is flagged as irreversible, destructive, or aimed outside your environment.
Anthropic announced the change alongside data that makes a straightforward case for it: in a controlled test of 1,053 planted dangerous commands, human reviewers caught 13.6% of them. The auto mode classifier caught 89%. Head to head, auto mode blocked 800 commands that humans waved through. Humans blocked only 6 that the classifier allowed.
Why human approval prompts were failing
The approval prompt model has always had a structural weakness. Claude Code historically asked for sign-off on every file write and every bash command, which is a safe default but not a practical one for any task longer than a few minutes. Anthropic’s data shows users approve 97% of all permission prompts. That is not a figure that suggests careful review. It suggests habitual clicking.
Anthropic calls this “manual review fatigue”, and the numbers bear it out. Early in a session, humans blocked roughly 17% of dangerous commands. After 50 or more prior prompts, that dropped to around 5%. The classifier’s block rate did not move. It does not get tired.
The gap between what the approval prompt model was supposed to do (give you meaningful control) and what it was actually doing (adding friction while providing the illusion of oversight) is what prompted the switch.
What auto mode actually does
The classifier adds a small number of extra tokens per tool call and scans tool results for potentially malicious instructions, including prompt injection attempts where third-party content tries to redirect Claude mid-task. If an action is flagged, Claude stops and asks. If it is not flagged, it proceeds.
There are also customisable “hard deny” rules. Users and enterprise administrators can permanently block specific categories of actions, such as data exfiltration attempts, regardless of context.
The system includes a fallback: if Claude hits three consecutive blocks, or 20 blocks in a single session, it reverts to manual approval mode for the rest of that session. You can also switch modes at any point using Shift+Tab.
Anthropic also commissioned an independent evaluation from Trajectory Labs, who tested 72 indirect prompt injection scenarios across the latest versions of Claude Code and OpenAI’s Codex as of 17 July 2026, each scenario run 10 times. None of the 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running in auto mode. GPT-5.6 Sol on Codex with automatic approval enabled allowed 5.83% of attacks through.
Internally at Anthropic, auto mode has already demonstrated practical value. In one session it prevented confidential data from being uploaded to a public page. In another long session, it stopped approximately 2,000 processes from being killed, which would have disrupted ongoing GPU training jobs.
What this means for you
If you are on Pro, Max, or Team: From 14 August 2026, new sessions start in auto mode. If you have already set a different default yourself, you will receive a one-time in-app notification asking whether you want to switch. If you have a pinned default, nothing changes automatically. You can switch back at any time with Shift+Tab.
The practical upside is that you can now kick off a long task, or several in parallel, and come back to finished pull requests rather than a queue of approval dialogs. Anthropic’s data shows that auto mode users on Team and Enterprise plans ship roughly 25% more pull requests.
The classifier token overhead that makes this work is now free on Pro, Max, and Team plans, effective immediately. You will not see it on your usage bill.
If you are on Enterprise or using the API: Auto mode remains opt-in for now across Claude Enterprise, the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud’s Agent Platform, and Microsoft Foundry. Anthropic plans to make it the default on those platforms within the coming month, in consultation with cloud partners, and will remove classifier overhead charges there too.
A note on what auto mode does not solve: Anthropic is clear that classifiers cannot eliminate risk and recommends human review for production changes. Security researchers have also flagged that malicious third-party packages could still exfiltrate data in ways the classifier may not catch. Auto mode is a meaningful improvement over reflexive approval clicking, but it is not a reason to skip code review.
The broader shift
Auto mode was first announced in March 2026 as an opt-in feature. Making it the default is a signal that Anthropic considers it ready for general use, and the internal adoption figures suggest the team agrees: Anthropic staff noted at the AI Engineer World’s Fair that “broadly within Anthropic, almost every single person uses auto mode.”
The move also fits a wider pattern. As coding agents take on longer and more complex tasks, the approval prompt model scales poorly. A model like Claude Opus 5 is built for extended agentic work. Pairing it with a system that interrupts every action defeats the purpose. Auto mode is the infrastructure that makes genuinely autonomous coding sessions practical, rather than just theoretically possible.
If you want to review the configuration options before 14 August 2026, the official Claude Code docs on auto mode cover what you can customise and how to set hard deny rules for your environment.