Claude Code: Auto Mode Becomes the Default for Pro, Max, and Team

Auto Mode Becomes the Default

Starting August 14, 2026, Anthropic is switching the default permission mode in Claude Code to auto mode for everyone on the Pro, Max, and Team plans. Any new session that hasn't been pinned to a specific default will run in auto mode automatically. Users who already set their own default get a one-time prompt asking whether they'd like to switch over; anyone with an organization-managed default sees no change at all. Enterprise, the Claude API, and other cloud platform deployments stay opt-in for now.

Why Anthropic Made the Switch

Claude Code's traditional permission model asks for a yes/no approval before every file write or shell command — safe, but tedious for long agentic sessions. Auto mode replaces that constant back-and-forth with a separate classifier model that reviews each tool call before it runs, looking for signs of irreversible, destructive, or out-of-scope actions: mass file deletion, credential exfiltration, commands that reach outside the current repository, or behavior that looks driven by instructions hidden in content Claude just read.

Anthropic's stated reason for flipping the default is blunt: its research found that people approve permission prompts reflexively rather than reading them. In a controlled study of 1,053 paid testers, human reviewers caught only about 13.6% of genuinely dangerous commands, and that accuracy fell to roughly 5% after fifty consecutive approvals in a session. The auto mode classifier, run against the same test set, blocked about 89% of the dangerous commands. Anthropic also reported that sessions which relied on manual approval contained serious unintended harm more than twice as often as sessions running in auto mode.

How the Classifier Behaves

When the classifier flags a call as risky, Claude Code doesn't just fail — it typically looks for a safer alternative path first, and only falls back to asking the user directly if it can't find one. A session automatically reverts to manual approval mode after three consecutive blocks, or twenty total blocks, so a user working in an unusually restrictive environment isn't stuck fighting the classifier indefinitely.

Anthropic described several layered safety mechanisms behind the classifier: hard deny rules that block data exfiltration outright regardless of context, awareness of repository visibility and git state before allowing destructive git operations, screening for prompt-injection patterns in content Claude has read from files or the web, and rules that distinguish access to secrets from access to public, non-sensitive data.

Independent red-teaming backed up Anthropic's internal numbers: Apollo Research's adversarial testing found the classifier missed only about 7% of synthetic attacks, and Trajectory Labs reported zero successful prompt-injection attacks against Claude models running in auto mode during its evaluation.

Already Running in Production

Anthropic paired the default-mode announcement with a companion post describing customers who had already standardized on auto mode ahead of the rollout. Nuro uses it to run overnight research agents that iterate against evaluation metrics and have a batch of pull requests ready by morning. Gusto adopted it explicitly as a security upgrade to cut down on permission fatigue, with an engineer noting that roughly 10% of sessions have triggered a classifier denial since May 2026. Garner Health built a standardized software development lifecycle around auto mode across 550 employees, enabling research-heavy work that manual-approval workflows made impractical. Anthropic also cited four enterprise customers — Adobe, Nuro, Gusto, and Garner Health — reporting roughly a 25% increase in pull request output among teams that adopted auto mode.

Pricing Change

Running the classifier costs a small number of additional tokens on every tool call. Alongside the default-mode switch, Anthropic stopped charging Pro, Max, and Team subscribers for that classifier overhead, effectively making the safety review free for the plans where auto mode is becoming standard.