Claude Code auto mode becomes default Aug 14 for Pro, Max, Team
New sessions will stop asking before running commands. Anthropic says humans catch 14% of malicious mid-session swaps to auto's 89% — plus how to sandbox it.
Copy markdown
The switch flips August 14
Auto mode becomes the default for new Claude Code sessions on Pro, Max, and Team — the agent runs commands and edits files without pausing for per-action approval. You can still switch back to manual per session or in settings.
Anthropic's case: humans are the weak link
In a test with 1,053 developers, when a harmful command was secretly swapped in mid-session, human reviewers caught just 13.6% of them — auto mode blocked 89%. Across 720 prompt-injection attempts, none got past Opus 5, Sonnet 5, or Fable 5 in auto mode.
The 11% you still own
Auto mode's guard still misses roughly 11%, and sophisticated supply-chain or injection attacks can slip through. Translation: don't point an unsupervised agent at prod credentials or your real filesystem without isolation.
Build this weekend: sandbox the unsupervised agent
Docker Sandboxes — GA since January, back on Hacker News' front page as auto mode lands — runs Claude Code, Codex, or Gemini CLI in a disposable microVM with only your project mounted and a network allow-list. It can install, delete, and spin up containers without touching your host. macOS and Windows now, Linux soon.