Claude Code auto mode is the default from August 14

You know the rhythm. Claude Code stops, shows you a shell command, waits. You hit yes. You have hit yes forty times today and you quietly stopped reading around the twelfth. That reflex is exactly what Anthropic designed around: from 14 August, auto mode becomes the default permission mode for new Claude Code sessions on Pro, Max and Team plans, so a separate classifier model vets each tool call instead of interrupting you. The announcement went up on 7 August with a study attached, and the stat everyone is repeating says the classifier blocked 89% of planted dangerous commands against 13.6% for the humans. We think the more honest number sits further down that post. There's also a billing change nobody put in a headline.

What changes, precisely

Not much, if you already picked a mode. That’s the part worth saying first.

Sessions on Pro, Max and Team that have never had a default set will start in auto mode from 14 August, with an in-app notification when it happens. Set a default yourself at some point? You get a one-time prompt asking whether you want to move, and declining leaves you where you are. Managed defaults pushed by an organisation don’t move at all.

Auto mode itself isn’t new. It has been available for months, and Boris Cherny, who runs Claude Code, told TechCrunch the team has used it exclusively “for many months”. What changed on 7 August is the default, plus the bill.

The number worth arguing about

Everyone quoted the 89%. Here’s the official framing, from the product account:

Starting August 14, auto mode will be the default permission mode in Claude Code for Pro, Max, and Team users. Auto mode reviews shell commands and actions with a separate classifier. In testing, it caught 89% of dangerous commands. Manual approval caught 14%.

@ClaudeDevs on X, 7 August 2026

The study behind it: 1,053 paid testers recruited through a research vendor, each handed a session where one permission prompt was swapped for an obviously dangerous command. The classifier blocked 937 of them. The humans caught 143. Put differently, auto mode blocked 800 commands a person had waved through, while people blocked 6 that auto mode allowed.

Take that with the appropriate salt. Anthropic ran this study on its own feature, and nobody has replicated it.

But the finding that survives the conflict of interest is the one further down: testers blocked about 17% of dangerous commands early in a session, dropping to roughly 5% after fifty or more prompts. The classifier’s rate held steady. That’s approval fatigue with a number attached, and honestly it’s the only part of the study I’d defend without hedging. Anyone who has run a two hour agent session knows the feeling of approving things on autopilot. Now there’s a measurement of it.

Anthropic also reports that users approve 97% of permission prompts. A gate you pass 97% of the time isn’t really a gate.

What it blocks

The classifier trusts your working directory and the git remotes that were configured when the session started. Everything else is external until you say otherwise. Remotes added mid-session with git remote add aren’t trusted, which is a nice touch.

The default block list is more specific than the marketing suggests. Force push. curl | bash. Production deploys and migrations. terraform destroy and its Pulumi, CDK and Terragrunt equivalents. Mass deletion on cloud storage. Granting IAM or repo permissions. Anything that irreversibly destroys files that existed before the session started. Plus a set of git commands the classifier presumes would discard uncommitted work, including git reset with the hard flag and git clean -fd.

There’s a subtler one. Entering auto mode drops your broad allow rules: blanket Bash(*), wildcarded interpreters like Bash(python*), package manager run commands, Agent allow rules. They come back when you leave. Narrow rules such as Bash(npm test) carry over untouched. So if you’ve built up a permissive allowlist over months, auto mode is stricter than what you had, not looser.

The parts still on you

Three details we’d want anyone to know before 14 August.

A boundary you state in conversation isn’t a rule. Tell Claude “don’t push until I review” and the classifier does honour it, but it re-reads that instruction from the transcript on every check. Context compaction can remove the message that stated it, and the boundary goes with it. For a guarantee, write an actual deny rule.

The fallback thresholds are fixed. Three blocks in a row or twenty across a session pauses auto mode and returns you to prompts. Neither number is configurable. That’s mostly sensible, though in headless runs with -p there’s nobody to prompt, so repeated blocks kill the session outright. Worth knowing if you drive Claude Code from CI.

And the classifier runs on Sonnet 5 by default rather than whatever you picked with /model, falling back to an Opus model when your session is on Fable 5.

Who actually pays

This is the bit that got lost. Pro, Max and Team users stopped being charged for classifier overhead on 7 August. Everyone else did not.

On Enterprise plans, and on accounts using the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud’s Agent Platform or Microsoft Foundry, classifier calls still count toward your token usage. Each check ships a slice of the transcript plus the pending action, so there’s latency on top of the tokens. Reads and working-directory edits skip the classifier entirely, meaning the overhead concentrates on shell commands and network operations, which is exactly the traffic an agentic session generates most of.

If you run Claude Code on the API for a team, that’s a real line item, and it’s arriving alongside a default change that makes the feature more visible.

Would we leave it on

Yes, with one caveat, and I might be wrong about the caveat.

The fatigue data convinced us. We were not carefully reading approval prompt number forty either, and pretending otherwise would be dishonest. A classifier that stays at 89% while our attention decays to 5% is a better guard than the one we were actually providing.

The caveat is scope. Anthropic’s own warning says auto mode reduces prompts without guaranteeing safety, and that’s not boilerplate. The classifier reasons about what your request implies, so it’s strongest on the catastrophic and weakest on the merely wrong. It will stop rm -rf ~. It won’t stop a confidently bad refactor across forty files, because nothing about that looks dangerous to a safety classifier.

So: auto mode for the work where you trust the direction, manual for anything touching things you cannot rebuild. Which is roughly what the docs say, and for once that advice isn’t hedging.

Sources

• Anthropic, “Auto mode is now the default in Claude Code for Pro, Max, and Team plans”, 7 August 2026, for the 14 August date, the 1,053 tester study, the 89% and 13.6% figures, the 937 and 143 counts, the 800 versus 6 comparison, the decay from 17% to 5%, and the end of classifier billing on those three plans.
• TechCrunch, “Anthropic is turning Claude Code’s auto mode on by default”, 9 August 2026, for the 97% prompt approval rate, the prompt injection screening and hard deny rules, and the Boris Cherny quote.
• Claude Code documentation, “Choose a permission mode”, for the default block list, the dropped broad allow rules, the conversational boundary behaviour and its interaction with context compaction, the three and twenty fallback thresholds, the headless abort, the Sonnet 5 classifier default, the settings file rules for defaultMode, and the token billing split across plans and providers.
• 9to5Mac, 7 August 2026 and Dataconomy, 10 August 2026, for independent confirmation of the date and the affected plans.

Frequently asked questions