Claude Code makes Auto Mode the default for Pro, Max, and Team
From Aug 14 a classifier vets every tool call instead of you — it caught 89% of risky commands to reviewers' 13.6%, and Auto Mode teams shipped ~25% more PRs.
Copy markdown
The approval prompt gives way to a classifier
Instead of asking you to OK each tool call, Auto Mode routes every action through a safety classifier that blocks irreversible, destructive, or out-of-environment commands, then finds a safer route or asks directly. It reverts to manual approval after 3 consecutive blocks or 20 in a session.
89% caught, where humans catch 13.6%
In a 1,053-person study the classifier flagged 89% of dangerous commands versus 13.6% for human reviewers, and just 2.4% of Auto Mode sessions saw a harmful unintended action against 6.3% of manually-approved ones. The catch: we habitually approve 97% of prompts anyway.
Default flips Aug 14 — how to keep the wheel
New sessions on Pro, Max, and Team switch to Auto Mode on Aug 14; Enterprise and the API stay opt-in for about a month. Toggle modes with Shift+Tab or the dropdown, and admins can pin a default or set disableAutoMode. The classifier's token overhead isn't billed.
25% more PRs, plus a couple of averted messes
Anthropic says Auto Mode teams ship roughly 25% more pull requests, and credits the classifier with stopping a public upload of confidential data and killing ~2,000 processes that would have toppled a GPU training run.
Anthropic's injection scoreboard: 720/720
In the same writeup Anthropic reports its models blocked all 720 prompt-injection attempts in its test while OpenAI's GPT-5.6 Sol let 5.83% through — a vendor benchmark, but worth weighing if you point agents at untrusted input.