Auto mode is now the default in Claude Code for Pro, Max, and Team plans
Simon Willison’s Weblog Simon Willison ● Covered by 37 sources
Claude Code will auto-approve actions by default on Pro, Max and Team plans starting August 14th. New evals claim it blocks most harmful commands that human reviewers miss.
Based on reporting by Simon Willison’s Weblog, Simon Willison — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Anthropic is flipping a big switch inside Claude Code. Starting August 14th, auto mode - where the coding agent runs actions without waiting for a human to click approve - becomes the default for new sessions across Pro, Max, and Team plans. This isn't a quiet experiment. At last month's AI Engineer World's Fair, Anthropic's Cat Wu and Thariq Shihipar said almost every single person inside the company already runs Claude Code this way.
The company backed that confidence with numbers. In a test involving 1,053 paid testers, a session would run normally until, partway through, a permission prompt got swapped for a command that was clearly dangerous. Every tester saw the exact same scenario. Only 13.6% of them caught it and refused. Auto mode, in comparison, would have blocked 89% of those actions on its own. That still leaves roughly 11% where it wouldn't have stepped in, and Anthropic isn't hiding that gap.
There's a second, thornier problem beyond accidental damage: prompt injection, where an attacker hides malicious instructions inside content the agent later reads and acts on. Here Anthropic leaned on a third party, Trajectory Labs, which tested Claude Code and Codex as of July 17th, 2026, across 72 indirect injection scenarios pulled from cases Anthropic hadn't seen. Out of 720 total attack attempts, none succeeded against Claude running Fable 5, Opus 5, or Sonnet 5 in auto mode. Thariq apparently joked the post should have been titled 'defeating the lethal trifecta.'
That's a striking claim, and one worth being cautious about before treating it as settled. It's easy to imagine attacks that don't fit neatly into a held-out test set - a malicious third-party package, for instance, that quietly instructs the agent to fetch and run something harmful as part of what looks like a routine build step. No permission model catches that kind of thing if the agent believes the instruction came from a trustworthy source. Confirmation fatigue is real, and constant approval prompts clearly aren't a safety strategy either, but replacing them with auto mode doesn't erase the underlying risk so much as change its shape.
My take — AI-written commentary, not fact-checked reporting
Anthropic funding its own hero numbers and then commissioning a friendly third party to bless the scarier claim is not the same thing as independent verification, and calling it that undersells how high the stakes are once agents get real access to file systems and networks. The 89% figure is genuinely useful context on human review being worse than people assume, but zero successful attacks out of 720 tries is the kind of result that deserves outside researchers trying to break it before anyone starts treating coding agents as safe by default. The smart move for teams adopting auto mode isn't trusting the marketing, it's still limiting what the agent can touch in the first place.
Read more about this at: Simon Willison’s Weblog