Auto Mode will soon be the default in Claude Code — because humans can’t be trusted

There's a certain irony baked into Anthropic's latest Claude Code update. The company built a coding agent, made it ask permission before doing anything risky, and then discovered that people are terrible at actually paying attention to those permission prompts. Anthropic's own research found users approve 97% of permission requests, which sounds less like careful review and more like reflexive clicking. So starting August 14, Auto Mode becomes the default for Pro, Max, and Team users, with Enterprise and API customers getting it as an opt-in for now before a default rollout within the month.

The numbers behind this decision are pretty stark. In testing with more than 1,000 people, human testers caught only 13.6% of dangerous commands on their own. Claude Code running in Auto Mode caught 89%. Worse, human performance degraded the longer a session ran — after 50 prompts, testers were only catching 5% of dangerous commands, suggesting that permission fatigue is real and it kicks in fast. Auto Mode works by using a separate classifier model that decides when a command needs a human's eyes; if it's flagged, Claude either finds a safer path or explicitly asks for approval, and there's a built-in circuit breaker that hands control back to the user after three consecutive blocks or twenty in one session.

Anthropic also spent time hardening the system before this rollout, and the most notable addition is what it calls hard denies — the classifier will never approve data exfiltration attempts, like pushing code or secrets somewhere external, no matter what a user asks for. Organizations can layer on their own hard deny rules too. The classifier now checks whether a git push or pull request is heading somewhere public, private, or trusted, and it reviews a repo's git status before running destructive commands like a hard reset, so it knows what uncommitted work might get wiped out. There's also a probe now screening content Claude pulls from web pages and tool outputs for prompt injection attempts.

To test how well this actually holds up, Anthropic ran a two-week red-teaming exercise with Apollo Research, injecting synthetic attacks into real workflows. Before the hardening work, the classifier missed 12% of these attacks; afterward, that fell to 7% on a held-out set. Anthropic also commissioned Trajectory Labs to compare its models against OpenAI's Codex on prompt injection resistance, and, unsurprisingly for a competitive benchmark a company paid for, its own numbers came out ahead — zero of 720 attacks got through in Auto Mode, versus OpenAI's GPT-5.6 Sol letting through 19% in full access mode and just under 6% in auto-review. Anthropic is careful to note that a classifier is a risk reducer, not a guarantee, and still recommends a human stay in the loop for anything touching production infrastructure.

Separately, Anthropic also rolled out a feature letting parallel Claude Code sessions message each other, sending a summary rather than full history or files so one session can pick up where another left off without you having to re-explain everything.