Anthropic Makes Claude Code Auto Mode the Default

Starting August 14, Anthropic is turning on Auto mode as the default permission system for Claude Code users on Pro, Max, and Team plans. This shift replaces the traditional manual approval workflow, where developers had to review every shell command and file write. Anthropic's data shows that human review is highly ineffective, catching only 13.6% of dangerous commands overall. In a 1,053-person study, human detection dropped to roughly 5% after 50 prompts, with users approving 97% of all requests. By mid-2026, nearly half of active CLI users had created broad Bash allow-rules, and 62% bypassed permissions entirely.

In contrast, Auto mode blocked 89% of dangerous commands in testing. In a third-party evaluation spanning 720 attack scenarios, zero prompt injection attacks succeeded against Claude models running this mode. The system uses a two-layer architecture. First, an input-layer probe scans external sources for prompt injections. Second, a two-stage output classifier evaluates tool calls before execution. Stage 1 is a rapid single-token filter, while Stage 2 applies chain-of-thought reasoning to flagged items, reducing the false positive rate from 8.5% to just 0.4%. To prevent manipulation, the classifier never sees Claude's internal reasoning or tool outputs.

For developers, this transition improves both security and velocity. Teams and Enterprise users running Auto mode shipped 25% more pull requests than those using manual approval. Companies like Adobe, Nuro, Gusto, and Garner Health have already adopted it as their production default. To encourage adoption, Anthropic has made the classifier overhead free, meaning the token cost of the safety classifier no longer counts toward usage limits on Pro, Max, and Team tiers.