Claude Code Auto Mode Is Now Default on Bedrock, Vertex, and Foundry

Claude Code v2.1.207 landed on July 11 with two defaults that enterprise teams need to catch before their next pipeline run: auto mode is now on by default across AWS Bedrock, Google Cloud Vertex AI, and Microsoft Azure Foundry, and all three platforms have switched their default model to Claude Opus 4.8. The same release patches a silent consent bypass that let CI jobs accept managed settings without ever surfacing a confirmation dialog. If your organization runs Claude Code on any of these cloud providers, here is what changed and what you need to do about it.

Auto Mode Is Now On by Default — Unless You Turn It Off

Until v2.1.207, enabling auto mode on Bedrock, Vertex AI, or Foundry required setting the CLAUDE_CODE_ENABLE_AUTO_MODE=1 environment variable. That opt-in is gone. Auto mode is now the default, which means Claude Code will execute file writes and bash commands without pausing for per-action approval prompts.

Auto mode is not reckless execution — it uses a classifier model that evaluates each action before it runs, blocking anything that touches sensitive system paths, mass-deletes files, or modifies .env files. But that classifier is not the same as a human reviewing every step. If your team has been running Claude Code on Bedrock under the assumption that it was in a more cautious mode, that assumption no longer holds.

To restore explicit approval gates, add this to ~/.claude/settings.json:

{
  "disableAutoMode": "disable"
}

Enterprise admins managing Claude Code across a team can lock it off in managed settings:

{
  "permissions": {
    "disableAutoMode": "disable"
  }
}

One more config detail: auto mode no longer reads from .claude/settings.local.json — the repo-resident file. It now reads exclusively from ~/.claude/settings.json at the user level. If you had autoMode configured in your repo, that setting is silently ignored in v2.1.207 and later. Move it to user-level settings.

The Security Fix CI Teams Should Not Skip

This release patches a meaningful security gap in non-interactive usage. When Claude Code ran through claude -p or the SDK — the pattern most CI/CD pipelines use — remote managed settings were being permanently recorded as consented without the consent dialog ever appearing. The dialog has no terminal to render in during a headless run, so it was effectively bypassed, and the system logged a permanent “accepted” for whatever settings were in play.

The consequence: policy changes in managed settings could propagate to automated pipeline runs with zero developer awareness. Given that CI environments often have elevated file system and network access, this was not a theoretical risk. Update to v2.1.207 if you are using Claude Code in any non-interactive context. You can review the full changelog for additional context on what managed settings affect.

Opus 4.8 Is the New Default on All Three Platforms

Bedrock, Vertex AI, and Claude Platform on AWS now default to Claude Opus 4.8. The model brings a 1M-token context window with 128k max output, and the effort parameter defaults to “high” across the board — which means more thinking tokens are allocated by default than on Opus 4.7.

A few specifics worth knowing before you hit unexpected token bills: the minimum prompt length for cache eligibility dropped from 2,048 to 1,024 tokens, which helps teams with shorter prompts. Opus 4.8 is also about four times less likely than 4.7 to silently pass over its own code flaws, which is meaningful for autonomous workflows. The downside is that “high” effort is more expensive than the previous defaults, so teams with strict cost budgets should retest their typical workloads before assuming continuity. See the Opus 4.8 Bedrock model card for pricing specifics.

The Fixes That Round Out This Release

Two additional issues resolved in v2.1.207 are worth flagging. The terminal freeze — where Claude Code would lock up and stop accepting keystrokes while streaming long lists, tables, or code blocks — is patched. This was a frequent complaint from developers working on large codebases where responses regularly spanned hundreds of lines.

The MCP headersHelper shell injection is also addressed: ${user_config.*} in shell-form commands is now rejected. The headersHelper field executes a shell command to generate HTTP headers for MCP server connections, and shell metacharacters in that field could enable command injection. Auto mode’s classifier design already guards against many execution risks, but this is a layer deeper — it is about what gets passed into MCP server configurations in the first place. Exec form or environment variables are the correct approach going forward.

What to Do Right Now

Three steps for teams on Bedrock, Vertex AI, or Foundry:

1. Update to v2.1.207 — pulls in the consent bypass fix and stability improvements. Run npm update -g @anthropic-ai/claude-code or equivalent for your install method.
2. Audit auto mode — decide whether your environment should run in auto mode. If not, add "disableAutoMode": "disable" to ~/.claude/settings.json before the next agent session.
3. Check your autoMode config location — if you had this setting in .claude/settings.local.json, it is now ignored. Migrate to ~/.claude/settings.json.

The broader signal here is that Anthropic is treating autonomous operation as the standard mode for cloud deployments, not the advanced option. Teams that have been deferring their auto mode policy decisions no longer have the luxury of a safe default.