What Changes on August 14

Auto mode itself is not a new feature — it was first introduced as an experimental option in March 2026 . What changed on August 14 is the default: any new Claude Code session started on a Pro, Max, or Team plan now launches in auto mode unless a user or organization administrator has pinned a different default . The switch does not apply to Claude Enterprise, the Claude API, or cloud-platform deployments (AWS Bedrock, Google Cloud's Agent Platform, Microsoft Foundry), which remain opt-in for now . Anthropic has stated it plans to make auto mode the default across those services within the following month .

If you already set a personal default before August 14, you may receive a one-time in-app prompt asking whether you want to switch to auto mode . Organization-pinned defaults are not overridden .

How Auto Mode Works

In auto mode, Claude Code does not pause to display a permission prompt on every action. Instead, each tool call is evaluated by a separate classifier model whose job is to judge whether the action is safe to execute . The classifier is designed to block actions that are irreversible, destructive, or aimed outside the user's own environment .

When the classifier blocks a command, Claude typically finds a safer way to proceed or asks the user directly for confirmation . If the classifier blocks three actions in a row, or twenty across a single session, the session automatically falls back to manual permission mode, ensuring the system cannot silently stall on unsafe tasks .

The Safety Data: Why Anthropic Made the Switch

Anthropic's rationale is grounded in a controlled study that highlights what the company calls a broken review model. The study involved 1,053 paid professional testers . Researchers swapped a single permission prompt in each session for a clearly dangerous command and recorded whether the tester approved it. The results:

• Auto mode classifier caught 89% of the injected dangerous commands (937 of 1,053) .
• Human testers clicking through prompts caught only 13.6% (143 of 1,053) .
• Users approved 97% of the permission prompts they were shown .
• Human detection rates degraded from roughly 17% early in a session to about 5% after fifty-plus prior approvals .

Anthropic also measured production-level harm: 2.4% of auto mode sessions showed harmful behavior versus 6.3% of hand-approved sessions . Independent third-party testing by Trajectory Labs found that zero of 720 indirect prompt injection attacks succeeded against Claude Code with auto mode enabled, compared to a 19% success rate against OpenAI's Codex in a comparable test .

On every measure tested, anthropic states that auto mode matched or outperformed manual human review .

Boris Cherny's Endorsement

Boris Cherny, head of Claude Code at Anthropic, has been a vocal proponent of auto mode. In a post on X (formerly Twitter) on August 7, 2026, he wrote: "The team and I use Auto mode exclusively, and have been for many months. I couldn't imagine going back to permission prompts! Really excited to get this out to everyone."

Cherny has repeatedly described auto mode as his number one tip for getting the most out of Claude Code, calling it "the key building block for multi-clauding" — running multiple parallel sessions simultaneously .

New Safety Features Added Alongside the Default Change

Alongside making auto mode the default, Anthropic introduced several new safety controls:

• Hard denies for data exfiltration attempts .
• Explicit rules for secrets handling and git push operations .
• Configurable allow/block rules so users and organizations can tell the classifier which repositories, cloud buckets, and domains are trusted .
• Automatic fallback to manual mode after repeated classifier blocks .
• Deny and explicit ask rules are evaluated before the classifier, meaning they still block or prompt regardless of what the classifier decides .

Anthropic also stopped charging Pro, Max, and Team users for the classifier's token overhead, effective immediately .

Who Is Affected

For users who want to keep manual permission prompts, the existing option to pin a different default remains available. Administrators can also enforce organization-wide defaults that override the change .

What Changes on August 14

Auto mode itself is not a new feature — it was first introduced as an experimental option in March 2026 . What changed on August 14 is the default: any new Claude Code session started on a Pro, Max, or Team plan now launches in auto mode unless a user or organization administrator has pinned a different default . The switch does not apply to Claude Enterprise, the Claude API, or cloud-platform deployments (AWS Bedrock, Google Cloud's Agent Platform, Microsoft Foundry), which remain opt-in for now . Anthropic has stated it plans to make auto mode the default across those services within the following month .

If you already set a personal default before August 14, you may receive a one-time in-app prompt asking whether you want to switch to auto mode . Organization-pinned defaults are not overridden .

How Auto Mode Works

In auto mode, Claude Code does not pause to display a permission prompt on every action. Instead, each tool call is evaluated by a separate classifier model whose job is to judge whether the action is safe to execute . The classifier is designed to block actions that are irreversible, destructive, or aimed outside the user's own environment .

When the classifier blocks a command, Claude typically finds a safer way to proceed or asks the user directly for confirmation . If the classifier blocks three actions in a row, or twenty across a single session, the session automatically falls back to manual permission mode, ensuring the system cannot silently stall on unsafe tasks .

The Safety Data: Why Anthropic Made the Switch

Anthropic's rationale is grounded in a controlled study that highlights what the company calls a broken review model. The study involved 1,053 paid professional testers . Researchers swapped a single permission prompt in each session for a clearly dangerous command and recorded whether the tester approved it. The results:

• Auto mode classifier caught 89% of the injected dangerous commands (937 of 1,053) .
• Human testers clicking through prompts caught only 13.6% (143 of 1,053) .
• Users approved 97% of the permission prompts they were shown .
• Human detection rates degraded from roughly 17% early in a session to about 5% after fifty-plus prior approvals .

Anthropic also measured production-level harm: 2.4% of auto mode sessions showed harmful behavior versus 6.3% of hand-approved sessions . Independent third-party testing by Trajectory Labs found that zero of 720 indirect prompt injection attacks succeeded against Claude Code with auto mode enabled, compared to a 19% success rate against OpenAI's Codex in a comparable test .

On every measure tested, anthropic states that auto mode matched or outperformed manual human review .

Boris Cherny's Endorsement

Boris Cherny, head of Claude Code at Anthropic, has been a vocal proponent of auto mode. In a post on X (formerly Twitter) on August 7, 2026, he wrote: "The team and I use Auto mode exclusively, and have been for many months. I couldn't imagine going back to permission prompts! Really excited to get this out to everyone."

Cherny has repeatedly described auto mode as his number one tip for getting the most out of Claude Code, calling it "the key building block for multi-clauding" — running multiple parallel sessions simultaneously .

New Safety Features Added Alongside the Default Change

Alongside making auto mode the default, Anthropic introduced several new safety controls:

• Hard denies for data exfiltration attempts .
• Explicit rules for secrets handling and git push operations .
• Configurable allow/block rules so users and organizations can tell the classifier which repositories, cloud buckets, and domains are trusted .
• Automatic fallback to manual mode after repeated classifier blocks .
• Deny and explicit ask rules are evaluated before the classifier, meaning they still block or prompt regardless of what the classifier decides .

Anthropic also stopped charging Pro, Max, and Team users for the classifier's token overhead, effective immediately .

Who Is Affected

For users who want to keep manual permission prompts, the existing option to pin a different default remains available. Administrators can also enforce organization-wide defaults that override the change .