Anthropic flips auto mode on for every new Claude Code session on Pro, Max and Team plans starting August 14. The company leans on a controlled study where auto mode caught close to 90% of dangerous commands while human reviewers stopped 13.6% of them. Enterprise and API deployments keep the old behaviour for a few more weeks.
Key Takeaways
- Auto mode becomes the default for new Pro, Max and Team sessions on August 14.
- Every tool call runs through a classifier that blocks irreversible, destructive and out-of-environment actions.
- Classifier tokens are no longer billed on those three plans.
Have an AI Sum Up This Article
ChatGPTThe Approval Prompt Leaves Pro, Max and Team Sessions
The change is an inversion. Until now the agent paused before anything sensitive and waited for a click. From August 14 it keeps going, and a classifier decides upstream whether a tool call deserves to be interrupted at all.
Three families of actions still trigger a stop: anything irreversible, anything destructive, anything pointing outside the developer’s own environment. That third bucket grew heavier once Claude Code shipped its own browser and started acting directly on the web, where a badly scoped command no longer stays inside a local repository.
Only new sessions on those three plans are affected. Anyone who already picked a different default gets a one-time prompt offering the switch, and a pinned default stays exactly where its owner left it.
Claude Enterprise, the API, Claude Platform on AWS, Amazon Bedrock, Google Cloud’s Agent Platform and Microsoft Foundry sit outside the rollout for now. Anthropic confirmed the same default is coming to those surfaces within the month, once admins have had time to review it, and walked through the whole setup in its official post announcing auto mode as the new default.
Two safeguards ship alongside the switch. Prompt injection screening comes first, aimed at the attack where poisoned content read by the agent smuggles in instructions the user never wrote. Customisable hard deny rules come second, letting a team lock specific operations shut no matter what the classifier decides.
The commercial gesture matters as much as the technical one. Tokens burned by the classifier are no longer billed to Pro, Max and Team users, at a moment when coding agent invoices have already startled plenty of engineering leaders this year. Charging for the safety layer would have been the fastest way to watch teams turn it off.
Human Review Stopped Only 13.6% of Dangerous Commands
Anthropic ran a controlled study with 1,053 paid testers. Auto mode blocked 89% of dangerous commands in that setup. Human reviewers caught 13.6%.
The reason behind the gap is less flattering than the headline number. Testers approved roughly 97% of the permission prompts put in front of them. Clicking approve had become muscle memory rather than a judgement call, which means the prompt had stopped protecting much of anything a while ago.
Production telemetry points the same way. Manually approved sessions carried unintended serious harm at 2.6 times the rate of auto mode sessions. Internal red teaming caught three significant incidents on top of that, including confidential data heading for public pages, destructive operations, and roughly 2,000 processes killed that would have disrupted GPU training jobs.
An outside audit by Trajectory Labs covers the injection side. Across 720 attempts, built from 72 scenarios run ten times each, none succeeded against Claude Fable 5, Opus 5 and Sonnet 5 running auto mode. The same protocol landed a 5.83% success rate against GPT-5.6 Sol.
All of this arrives while Anthropic keeps publishing what its own models did wrong, including the blackmail attempt Claude produced inside a test environment. Auto mode does not claim to erase that class of behaviour. It moves the checkpoint ahead of execution instead of parking it on a click.
More articles on Horizon
- We Tested Taskade, the AI Workspace That Builds Apps
- Astra Cyber Risk May Reach OpenAI’s Top Level
- AI Agent Energy Now Hits 150 Wh per Request
What the Switch Forces on Teams and Rivals
For a developer the difference shows up in the first session: fewer interruptions, an agent that keeps moving. Anthropic measured around 25% more pull requests from teams already running auto mode. Boris Cherny, who heads Claude Code, wrote that his team has used it exclusively for many months.
For an engineering organisation the question moves up a level. The setting now lives with administrators through managed settings, with the option to disable auto mode entirely from a configuration file. That is an internal policy call to make before August 14, not after.
Companies that already ruled on the tool sit this one out, as Alibaba did when it blocked Claude Code for its employees. Everyone else now faces a fresh version of the same trade-off: accept an agent that decides on its own, or ship a policy stricter than the vendor’s own default.
Anthropic draws the line itself. For high-stakes changes to production infrastructure the company still recommends reviewing Claude’s actions by hand. Auto mode is framed as the right default, not as a blank cheque.
Competitively, the bar just moved. A published injection success rate becomes a comparison point in the same way price per million tokens already is. Rival coding agents that still leave every command to the user’s judgement will have to argue why their approval prompt beats an automatic filter, when the documented reflex is to approve almost everything.
Then there is the bill. An agent that stops less often consumes more, and Microsoft dropping Claude Code after burning through its AI budget is a useful reminder that smoothness costs money. Auto mode has been in testing since March and just left its optional phase, so the number worth watching next is not the block rate but the monthly invoice of the teams that keep it on.
Follow the story on Horizon.
