Claude Code Auto Mode Is Now Default: What to Do Before August 14

Two days from now, every new Claude Code session on a Pro, Max, or Team plan will start in auto mode by default. No per-action approval prompt. No confirmation before Claude runs a shell command. A two-stage safety classifier takes over that job instead — and the data says it is significantly better at it than you are.

What Changes on August 14

Anthropic announced that auto mode will become the default permission setting for all new Claude Code sessions on Pro, Max, and Team plans starting August 14, 2026. Enterprise, API, Amazon Bedrock, and other cloud platform deployments remain opt-in for now, with a default rollout planned within the following month.

In practice, this means Claude Code will proceed with actions autonomously unless the classifier determines an action is irreversible, destructive, or aimed at systems outside your local environment. When the classifier flags something, it either finds a safer path or surfaces a prompt for your explicit approval. When it does not flag it, the action runs.

Users who already pinned a different default in their settings will see no forced change — Anthropic will surface a one-time prompt asking whether they want to transition. If you have done nothing to configure Claude Code’s permission mode, August 14 is when your sessions change.

Why Humans Lost This Job

The statistical case for this change is uncomfortable but hard to dispute. In a controlled study with 1,053 professional developers, Anthropic secretly swapped a routine permission prompt mid-session with a clearly dangerous command. Auto mode caught it 89% of the time. Human reviewers caught it 13.6% of the time.

The gap widens as sessions progress. Early on, humans caught roughly 17% of dangerous actions. After 50 or more prior prompts, the catch rate collapsed to around 5%. Decision fatigue is real and measurable, and it happens inside a single working session.

The production numbers are equally blunt: sessions running in manual approval mode contained serious unintended harm 2.6 times more often than sessions running in auto mode during Anthropic’s May–June 2026 data collection. And as Boris Cherny, head of Claude Code, put it: “The team and I use auto mode exclusively, and have been for many months. I couldn’t imagine going back to permission prompts.”

The underlying reality is that 97% of all permission prompts were being approved reflexively. The approval step had become a friction point that generated false confidence, not actual safety. Anthropic’s position is that a well-designed classifier is more reliable than a fatigued developer clicking through prompts.

How the Classifier Works

The system runs a two-stage pipeline on every tool call. A fast single-token filter runs first and flags approximately 8.5% of real traffic as potentially suspicious. Flagged actions go to a second stage: a chain-of-thought reasoning pass that reduces false positives to around 0.4%.

Tool results — the output of commands Claude has already run — are stripped from the classifier’s input. A hostile file or fetched page cannot address the classifier directly. A separate input-layer probe scans those results for prompt injection patterns before Claude reads them.

If the classifier triggers blocks three consecutive times, or twenty times total in a session, it pauses and restores manual prompting. Headless runs via the -p flag abort the session rather than prompt. Neither threshold is configurable, so CI/CD pipelines should account for this before tightening deny rules.

What You Should Configure Before August 14

Auto mode does not mean unrestricted access. The permission hierarchy has three tiers, and developers should set policies at the appropriate level before the default switches:

• Hard denies — entries in permissions.deny block before the classifier runs and cannot be overridden by user settings or classifier decisions. Use these for actions you never want under any circumstances.
• Ask rules — adding Bash(git push *) and Bash(gh pr create *) to permissions.ask in your ~/.claude/settings.json means Claude pauses before pushing code or opening pull requests, while proceeding autonomously through everything else.
• Disable entirely — set permissions.disableAutoMode to disable in managed settings. Enterprise admins can enforce this organization-wide and prevent individual developers from re-enabling it.

{
  "permissions": {
    "ask": [
      "Bash(git push *)",
      "Bash(gh pr create *)"
    ],
    "deny": [
      "Bash(aws s3 cp * s3://*)"
    ]
  }
}

Run claude auto-mode config to see your active settings and claude auto-mode critique to evaluate whether your custom rules are structured correctly. Configuration files live at /etc/claude-code/ on Linux/WSL and /Library/Application Support/ClaudeCode/ on macOS.

The Honest Concern

Simon Willison’s analysis frames the core risk clearly: the classifier is a single point of failure. If it has a blind spot — or if an attack manages to route around it — there is no human backstop. He specifically flagged malicious third-party packages that embed exfiltration instructions as a supply-chain vector the classifier may not reliably detect.

Apollo Research’s hardened red-team evaluation found a 7% miss rate on synthetic adversarial attacks after Anthropic’s hardening work. That is a real residual risk. Auto mode also does not catch logic errors, subtle business-logic mistakes, or situations where Claude does exactly what it was told but the instruction itself was wrong.

As TechCrunch reported, Anthropic absorbed the token cost of running the classifier for affected tiers — financially, this is a zero-cost change for developers. But the tradeoff is concentrating safety logic into a system that has not yet been independently audited at scale.

The Bottom Line

The argument for auto mode is not that it is perfect. It is that human approval at scale was already broken. A 13.6% catch rate is not oversight — it is an illusion of oversight. Auto mode replaces approval theater with a system that consistently catches most dangerous actions and does not get worse after the 50th prompt of the day.

If you are on Enterprise or API today, set your policies now rather than waiting for the default to land. If you are on Pro, Max, or Team, decide before August 14 whether to accept the new default or configure your exceptions. As The Register put it: auto mode is now in the driver’s seat. The question is what guard rails you set before handing over the keys.