Claude Code makes Auto Mode default: no more per-step approvals
As of today, Pro/Max/Team route each tool call through a safety classifier instead of you — it flagged 89% of dangerous commands to human reviewers' 14%.
Copy markdown
Approvals are out, a classifier is in
Claude Code no longer prompts you to approve each tool call on Pro, Max, and Team plans. Instead every action routes through a classifier that blocks anything irreversible, destructive, or aimed outside your environment — the default as of August 14, 2026.
The safety math behind the switch
In a 1,053-user test the classifier caught 89% of deliberately dangerous commands versus 13.6% for human reviewers, and 2.4% of auto sessions ended in unintended harm versus 6.3% for manual ones. None of 720 prompt-injection attempts got through.
Your escape hatches
Prefer to keep approving things yourself? Toggle modes with Shift+Tab in the CLI or the mode dropdown in Desktop; admins can pin `defaultMode` in managed settings or kill it entirely with `disableAutoMode`. Auto Mode also self-reverts to manual after three blocks in a row or twenty across a session.
You're not paying for the classifier
Anthropic is absorbing the extra token cost of running the classifier for Pro, Max, and Team subscribers, so the added safety layer doesn't count against your usage limits.
Enterprise and API are next
The new default is opt-in for Enterprise, API, and cloud-platform users for now, but Anthropic plans to flip it on for them within a month. Security analysts flag one tradeoff: a single shared classifier becomes a central point of failure if it is ever compromised.
Elsewhere: Claude Code 2.1.232 lands
The same week's release turns on subagent forking by default — with full conversation and prompt-cache inheritance — and lets you @-mention other running Claude sessions by name to hand work between them.