The "confirmation fatigue" that drove the change

Anthropic's internal telemetry showed that users approved 97% of permission prompts — regardless of how dangerous the command actually was . This near-universal approval rate reflected not careful evaluation but habitual clicking-through, especially in long sessions where prompt fatigue set in rapidly . In the controlled study, human refusal rates collapsed from an already-low 13.6% to roughly 5% after 50+ prompts, confirming that the per-approval model degraded badly over time .

89% auto-block rate vs. human refusal in the 1,053-person study

• Human catch rate: In a double-blind test with 1,053 paid professional testers, a planted dangerous command was blocked only 13.6% of the time (143 of 1,053 people refused it) . After 50 prompts, that fell to ~5% .
• Auto mode catch rate: The classifier blocked 89% of the same planted dangerous commands .
• In production, manually-approved sessions produced unintended harm twice as often as auto mode sessions .

Residual risks: 11% miss rate and zero prompt injection catches

• 11% miss rate: The classifier fails to block roughly 11% of dangerous commands .
• Synthetic adversarial evaluations: Third-party red-teaming exercises cut the classifier's miss rate further but could not eliminate misses entirely . The system caught zero prompt injection attacks in testing, though this may reflect the test design rather than a general immunity .
• Edge cases: Highly novel or obfuscated malicious commands that fall outside the classifier's training distribution remain a residual risk .

Guardrails and override mechanisms

• The classifier evaluates each tool call independently — auto mode is not a blanket permission grant .
• Users can switch back to manual approval mode at any time within a session .
• Team and Enterprise admins can pin a default mode (manual or auto) for their entire organization, overriding the user-level default .
• Anthropic's external red-teaming program continues to probe and harden the classifier .
• For Enterprise accounts, auto mode remains opt-in for now, with a default flip planned within about a month of the initial rollout .

Rollout and pricing implications by segment

Key pricing note: Anthropic confirmed it has stopped charging users on these plans for the additional classifier tokens that auto mode consumes — those costs are now absorbed into the existing subscription .

The "confirmation fatigue" that drove the change

Anthropic's internal telemetry showed that users approved 97% of permission prompts — regardless of how dangerous the command actually was . This near-universal approval rate reflected not careful evaluation but habitual clicking-through, especially in long sessions where prompt fatigue set in rapidly . In the controlled study, human refusal rates collapsed from an already-low 13.6% to roughly 5% after 50+ prompts, confirming that the per-approval model degraded badly over time .

89% auto-block rate vs. human refusal in the 1,053-person study

• Human catch rate: In a double-blind test with 1,053 paid professional testers, a planted dangerous command was blocked only 13.6% of the time (143 of 1,053 people refused it) . After 50 prompts, that fell to ~5% .
• Auto mode catch rate: The classifier blocked 89% of the same planted dangerous commands .
• In production, manually-approved sessions produced unintended harm twice as often as auto mode sessions .

Residual risks: 11% miss rate and zero prompt injection catches

• 11% miss rate: The classifier fails to block roughly 11% of dangerous commands .
• Synthetic adversarial evaluations: Third-party red-teaming exercises cut the classifier's miss rate further but could not eliminate misses entirely . The system caught zero prompt injection attacks in testing, though this may reflect the test design rather than a general immunity .
• Edge cases: Highly novel or obfuscated malicious commands that fall outside the classifier's training distribution remain a residual risk .

Guardrails and override mechanisms

• The classifier evaluates each tool call independently — auto mode is not a blanket permission grant .
• Users can switch back to manual approval mode at any time within a session .
• Team and Enterprise admins can pin a default mode (manual or auto) for their entire organization, overriding the user-level default .
• Anthropic's external red-teaming program continues to probe and harden the classifier .
• For Enterprise accounts, auto mode remains opt-in for now, with a default flip planned within about a month of the initial rollout .

Rollout and pricing implications by segment

Key pricing note: Anthropic confirmed it has stopped charging users on these plans for the additional classifier tokens that auto mode consumes — those costs are now absorbed into the existing subscription .