Anthropic said Claude Code will start enabling Auto Mode by default on Aug. 14 for newly created sessions under its Pro, Max, and Team plans. Instead of repeatedly stopping for user approval, Claude Code will have an independent safety classifier review each action before it runs.
The company said the shift came out of a controlled experiment. Anthropic recruited 1,053 paid professional testers through a research vendor and had them write code in a dedicated testing environment rather than on their own projects. Participants knew they were being evaluated, but under the blind-test design they were not told which behavior was actually being measured. Midway through a session, one permission prompt was quietly replaced with an obviously dangerous command, and the researchers recorded only whether the participant clicked approve.
Humans blocked just 13.6% of the dangerous prompts, according to Anthropic. The Auto Mode classifier blocked 89%. The company said the findings suggested manual approval was a weak control, not because users lacked expertise, but because the pop-up itself had become instinctive.
Repeated prompts pushed human interception rates even lower
Anthropic said the decline became more severe over time. In the same line of testing, once users had processed more than 50 permission confirmations, the human interception rate fell to about 5%.
The company also said in its engineering blog that Claude Code users approve 93% of permission requests. That figure formed part of the rationale for moving Auto Mode into the default position.
What the classifier allows and what it blocks
According to Claude Code documentation, the classifier trusts the user’s working directory and remote sources that were already configured when the session began.
Actions allowed by default include:
- local file operations inside the working directory
- dependency installation based on a lock file or manifest
- reading .env files and sending credentials to the API they correspond to
- read-only HTTP requests
- pushing to any branch in the repository currently being worked on
Actions blocked by default include:
- download-and-run behavior such as curl | bash
- sending sensitive data to an external endpoint
- production deployments and data migrations
- large-scale deletions in cloud storage, along with granting IAM or repository permissions
- force push and terraform destroy
- commands such as git reset --hard and git clean -fd that discard uncommitted changes
The classifier runs on Claude Sonnet 5
Anthropic said the classifier itself runs on Claude Sonnet 5, regardless of which model a user selects through the /model setting. It can see user messages, tool calls, and CLAUDE.md, but it cannot see tool outputs.
The company said that design is intentional. It is meant to close off a common prompt injection path, preventing malicious instructions hidden in files or web pages from speaking directly to the classifier. Tool outputs are scanned separately by a server-side probe before Claude can read them.
Auto Mode pauses if too many actions are blocked
Anthropic said Auto Mode does not remain permanently open-ended. If the classifier blocks three actions in a row, or blocks 20 actions across a single session in total, Auto Mode automatically pauses and returns to per-action approval until the user approves one request. The company said those two thresholds cannot be changed.
User-defined boundaries stated in conversation can also act as blocking signals. If a user tells Claude something like “don’t push yet” or “wait for me to review before deployment,” the classifier can block the action even if the default rule would otherwise allow it.
Anthropic added that this kind of boundary is not a hard rule. It is reread from the conversation record each time, so if context is compressed and the instruction drops out, the protection may no longer apply. For a strict guarantee, the company said a deny rule still needs to be written.
Classifier token charges removed for some plans
Each classifier decision consumes additional tokens, Anthropic said. Effective immediately, that classifier overhead will no longer be charged to Claude Code users on Pro, Max, and Team plans.
Enterprise accounts, along with accounts using Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud Agent Platform, and Microsoft Foundry, will still have classifier calls counted toward token usage. Auto Mode also still needs to be enabled manually in those environments for now, though Anthropic said it plans to switch them to default-on within a month.
The company also said Team and Enterprise customers that enabled Auto Mode produced about 25% more pull requests.
Anthropic still recommends human review for high-risk production changes
Anthropic said in its announcement that Auto Mode reduces risk for most users, but does not eliminate it because the system still depends on classification. For high-risk changes to production infrastructure, the company said users should still inspect what Claude actually did.
Users can switch back to manual approval
In its FAQ, Anthropic described Auto Mode as one of Claude Code’s permission modes, with an independent classifier reviewing each action in place of repeated approval prompts. Safe actions pass automatically, while irreversible actions or operations that could send data outward are blocked.
Users can still switch back to manual confirmation after Auto Mode becomes the default. Anthropic said the CLI supports cycling modes with Shift+Tab, while the desktop app and VS Code version offer the setting through a mode menu. Users who have already chosen a default mode will not be changed automatically and will instead receive a one-time prompt. Organization-managed defaults will also remain unchanged.
The report was based on Anthropic’s official announcement and engineering blog, as cited in the original BlockTempo coverage.