Auto Mode will soon be the default in Claude Code — because humans can’t be trusted

Anthropic just admitted something uncomfortable about its own users: they don't read the warnings. According to the company's research, people approve 97% of permission prompts in Claude Code, and after 50 prompts in a row, testers caught barely 5% of genuinely dangerous commands. Compare that to Claude running in Auto Mode, which caught 89% of the same risky actions across more than 1,000 testers. Starting August 14, that mode becomes the default for Pro, Max, and Team subscribers, with Enterprise and API users getting it within the month.

The mechanics are straightforward. A separate classifier model watches every command Claude Code wants to run and decides, in real time, whether it's safe enough to skip the human checkpoint. When something looks risky, Auto Mode doesn't ask — it blocks the action outright, then either finds a safer path or kicks the decision back to the user. There's a circuit breaker built in too: three blocks in a row, or twenty in one session, and control reverts to manual approvals. Anthropic frames this as a way to make the permission prompts that do show up actually mean something, rather than training people to click through on autopilot.

The more interesting work happened around hardening the classifier against actual attacks. Data exfiltration — pushing code or secrets somewhere external — is now a hard deny, full stop, no override without stepping outside Auto Mode entirely. The classifier also checks whether a git push is headed to a public repo, a private one, or something trusted, since the same command can be perfectly normal or a serious leak depending on the destination. It now inspects git status before letting a destructive command like git reset --hard wipe out uncommitted work, and it screens content pulled from web pages and tool outputs for prompt injection attempts. Anthropic brought in Apollo Research for a two-week red-teaming pilot, and the hardening cut missed synthetic attacks from 12% down to 7%.

Anthropic also used this rollout to take a swing at OpenAI, commissioning Trajectory Labs to run 720 prompt injection attacks against both platforms. Auto Mode blocked every single one. OpenAI's GPT-5.6 Sol in Codex, by contrast, let through 19% of attacks in full-access mode and roughly 6% even with its own auto-review switched on. Anthropic is careful to add the obvious caveat: a classifier reduces risk, it doesn't erase it, and for anything touching production infrastructure, a human should still be watching.

Alongside the permissions overhaul, Anthropic quietly shipped something that could matter just as much for actual workflow — parallel Claude Code sessions can now message each other, sending task summaries so one session can pick up where another left off without a developer re-explaining the whole context by hand.