Anthropic is making auto mode the default setting for new Claude Code sessions on Pro, Max, and Team plans starting August 14, according to TechCrunch and a link-blog write-up by Simon Willison. Auto mode, first released as a test version in March, lets Claude Code proceed without asking for human approval at each step, stopping only when an action is determined to be "irreversible, destructive, or aimed outside your environment," per Anthropic's announcement.
Anthropic published evals to support the change. In a study of 1,053 paid testers, a single permission prompt was swapped mid-session for a clearly dangerous command; 13.6% of humans refused it, while auto mode would have blocked 89% of those actions. Anthropic noted users approve 97% of permission prompts in Claude Code. On prompt injection, Anthropic said a third-party evaluation by Trajectory Labs tested 72 indirect prompt injection scenarios, and that none of 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 in auto mode.
Willison, who has predicted security failures for coding agents in 2026, wrote he wants "more independent confirmation" and described attack vectors like malicious packages he is unsure auto mode could stop. Claude Code Head Boris Cherny said on X that his team uses auto mode exclusively.
- Auto mode becomes the default for Claude Code Pro, Max, and Team plans starting August 14
- In a study of 1,053 testers, auto mode would have blocked 89% of a planted harmful action vs 13.6% caught by humans
- Anthropic says users approve 97% of Claude Code permission prompts
- A Trajectory Labs eval reported 0 of 720 prompt-injection attempts succeeded against Claude models in auto mode across 72 scenarios
- Auto mode stops only for actions deemed irreversible, destructive, or aimed outside the user's environment
What it means for you
Claude Code is a tool developers use to write and change code by giving instructions in plain language. Until now it paused to ask permission before most actions; soon it will just do them unless the action looks dangerous. Anthropic's own data suggests this is actually safer than asking a human to click 'approve' every few seconds, because people rubber-stamp almost everything anyway. But some experts, including Simon Willison, say the harder problem — hidden malicious instructions sneaking in through code or web content — is not clearly solved.
Try this
If you or your team use Claude Code, check your settings before August 14 and decide whether you want auto mode on. If you do use it, set 'hard deny' rules for anything sensitive and keep it away from production systems and real customer data.
Who should care
Developers and technical teams already using Claude Code, and anyone letting an AI coding agent run against live systems or private data.
Skip this if
You don't use Claude Code or coding agents. This changes a default in a developer tool and has no bearing on general chatbot or business use.
Sources: Simon Willison, TechCrunch AI — read the original