Claude Code makes auto mode default Aug 14: an AI vets each command
Anthropic's data: humans rubber-stamp most risky commands. The classifier blocks 89%, shrugs off prompt injection, and reverts to manual on a block spree.
Copy markdown
Auto mode becomes the default Aug 14
From August 14, Claude Code runs in auto mode by default for Pro, Max, and Team: an AI classifier approves or blocks each tool call instead of you clicking 'yes' on every command. Enterprise, the API, Bedrock, Vertex, and Foundry get it about a month later, and stay opt-in.
Humans rubber-stamp; the classifier doesn't
In a 1,053-tester study, manual reviewers caught just 13.6% of dangerous commands versus 89% for auto mode, and clicking through was more than twice as likely to let a harmful action run. Anthropic says users already approve 93% of prompts — the 'human in the loop' was mostly a rubber stamp.
0.4% false positives, and three dials you control
On 10,000 real actions the full pipeline wrongly flagged only 0.4%, so it shouldn't nag you. You shape it with three slots — environment trust boundaries, block rules, and allow exceptions — and it judges real-world impact, not raw command syntax.
Prompt injection drops to 0%
Against prompt-injection attacks, Claude in auto mode had a 0% success rate, versus 5.83% for GPT-5.6 Sol and 19.03% for Claude in full-access mode. If your agent touches untrusted web pages or repos, that's the line that matters.
A guardrail on the guardrail
It's not a blank check: after 3 consecutive blocks or 20 in a session, Claude Code stops and hands control back to you — or terminates in headless mode. Denials return with an instruction to respect the boundary in good faith, not route around it.
What to check before Aug 14
Expect a one-time prompt if you'd picked a different default, and test your headless and CI runs first — a block spree now aborts the job instead of pausing for you. Enterprise admins keep it opt-in while they evaluate.