Anthropic announced on August 7, 2026, that auto mode will become the default permission setting for Claude Code on Pro, Max, and Team plans starting August 14. Auto mode replaces per-action approval prompts with a background AI classifier that evaluates each tool call before execution, blocking irreversible, destructive, or out-of-bounds actions. If blocked, Claude can try a safer route or ask permission. After repeated blocks, sessions fall back to manual approval. Anthropic will no longer charge for the small token overhead of the classifier.
In testing of 1,053 paid users, Anthropic found human reviewers caught only 13.6% of dangerous commands, compared with 89% for auto mode. A third-party evaluation by Trajectory Labs tested 72 indirect prompt injection scenarios and found auto mode blocked attacks that would cause sensitive-data exfiltration, financial fraud, or credential phishing. Among flagged sessions, those going through manual approval contained serious unintended harm more than twice as often as auto mode sessions. The shift addresses a practical bottleneck: developers cannot safely kick off large tasks without frequent approval interruptions.
For teams shipping production code agents, this signals Anthropic's confidence in AI-driven permission governance as a default rather than exception. The company notes that classifiers cannot eliminate risk and recommends human review for production changes. Notably, OpenAI opted out of auto mode for GPT-5.6 as a precaution, so Anthropic is taking a divergent stance on agent autonomy. Data from Team and Enterprise customers shows auto mode users ship ~25% more pull requests, suggesting operational velocity gains. Enterprise and API users can still opt in; Anthropic plans to make it default across all platforms within a month.