Anthropic Makes Auto Mode Default in Claude Code
Anthropic will make auto mode the default permission setting in new Claude Code sessions for Pro, Max, and Team plans on August 14. The company said its classifier evaluates tool calls for irreversible, destructive, or out-of-environment actions, replacing repeated approval prompts. Anthropic's testing found auto mode outperformed manual review at catching dangerous commands, while Enterprise, API, and cloud-platform deployments remain opt-in initially.
Anthropic will enable auto mode by default for new Claude Code sessions on Pro, Max, and Team plans starting August 14. Users or administrators with another permission mode pinned as the default will not be changed, according to Anthropic's August 7 product announcement.
Auto mode routes each Claude Code tool call through a classifier intended to block irreversible, destructive, or out-of-environment actions rather than asking users to approve each command. Anthropic said Claude Code generally either selects a safer path or requests direct approval after a block. The session reverts to manual approvals after three consecutive blocks or 20 blocks during a session.
Anthropic also said it has stopped charging Pro, Max, and Team users for the classifier's additional token overhead, which it characterized as a small number of tokens per tool call.
Testing manual approval against classification
The company reported that it evaluated auto mode through internal and third-party red teaming, prompt-injection evaluations, production-session analysis, and a controlled study involving 1,053 paid testers. Anthropic said auto mode matched or outperformed manual review across the measures it tested.
9to5Mac, citing Anthropic's results, reported that human reviewers identified 13.6% of dangerous commands, compared with 89% for auto mode. The outlet also reported that human performance fell to about 5% after 50 approval prompts. These results concern Anthropic's own testing environment and should not be read as an independent benchmark of all coding-agent permission systems.
Anthropic cautioned that classifiers do not eliminate risk and recommended human review for production changes. That limitation remains material for teams granting coding agents shell, repository, cloud, or deployment access: classifier-mediated execution can reduce repeated-interaction fatigue, but it does not replace change controls, sandboxing, credential scoping, code review, or rollback procedures.
Rollout boundaries
Auto mode remains opt-in for Claude Enterprise, the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry. Anthropic wrote that it intends, in collaboration with cloud partners, to make the setting default across those services in the coming month; Enterprise administrators can already configure auto mode as the default through managed settings.
The change is tied to longer-running autonomous work. Anthropic said this makes models designed for such workloads, including Claude Opus 5, more practical to leave operating for hours. Separately, 9to5Mac reported Anthropic's claim that auto-mode users at Team and Enterprise customers ship about 25% more pull requests.
For ML platform and developer-tooling teams, the rollout puts permission architecture at the center of agent usability. Comparable agent deployments commonly face a tradeoff between frequent human confirmation, which can become ineffective under alert fatigue, and automated policy enforcement, which requires careful evaluation against the specific tools and environments an agent can reach.
Key Points
- 1Anthropic defaults Claude Code to classifier-mediated permissions for eligible paid plans, reducing repeated manual approvals during agent tool execution.
- 2Anthropic's 1,053-tester study reported substantially higher dangerous-command detection for auto mode, though the results are vendor-generated and environment-specific.
- 3Comparable coding-agent deployments require layered controls because automated command classification does not replace sandboxing, scoped credentials, review, and rollback mechanisms.
Scoring Rationale
This is a notable default-setting change for a widely used AI coding agent, with direct implications for how teams balance autonomous execution and permission controls. The reported evaluation data is relevant to practitioners designing agent governance, but it remains a vendor-published result rather than an independent benchmark.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
