Anthropic Makes Claude Code's Auto Mode Default, Cutting Dangerous Command Approvals by 75 Percentage Points

Auto Mode Becomes Standard, Not Optional

Anthropic will switch on Auto Mode by default in Claude Code starting August 14, 2026, for Pro, Max, and Team plan users. Only Enterprise customers will still need to opt in manually, according to a company blog post. The change removes the step-by-step manual approval that previously gated the AI coding agent's actions, letting Claude Code execute tasks autonomously except when a built-in classifier flags an action as dangerous or irreversible.

The shift is backed by data Anthropic collected from 1,053 paid testers and internal red-teaming exercises. According to the company, human reviewers manually approving each Claude Code action caught only 13.6% of dangerous commands during testing. Auto Mode's classifier caught 89% of the same dangerous commands. Teams running Auto Mode also produced roughly 25% more pull requests than teams using manual approval, suggesting a meaningful throughput gain alongside the safety numbers.

Prompt Injection Resistance Claims

Anthropic also points to results from an independent audit conducted by Trajectory Labs, which ran 72 distinct prompt injection attack scenarios ten times each — 720 total attempts — against Claude's current model lineup (Fable 5, Opus 5, and Sonnet 5) running in Auto Mode. None of the 720 attempts succeeded, according to the audit. By comparison, the same audit reportedly found that OpenAI's GPT-5.6 Sol running in Codex's Auto-Review mode was breached in 5.83% of attempts. These figures come from Trajectory Labs' testing as cited by Anthropic; independent replication has not been confirmed.

Anthropic cites two internal incidents as evidence of Auto Mode's value: the classifier blocked an attempt to upload confidential data to a public-facing page, and during one extended session it terminated roughly 2,000 processes that would have interrupted active GPU training jobs.

Anthropic says it does not charge for tokens consumed by the classifier itself. Pricing for Claude Code plans otherwise remains unchanged; specific per-token rates for Auto Mode's underlying models were not disclosed in the announcement.

What This Means

Making Auto Mode the default marks a structural shift in how developers interact with AI coding tools. Claude Code is already the most widely used product in this category, so this change effectively resets the norm for a large developer population — from active line-by-line approval to passive oversight of an agent that mostly runs unsupervised.

The economics favor Anthropic regardless of intent: an agent that works longer and completes more tasks per session consumes more tokens, which increases revenue even though the company frames the change primarily as a safety and productivity improvement.

The harder problem is the one Anthropic itself flags: as developers step back from granular review, their ability to catch subtle, high-stakes problems depends on spot-checks rather than continuous engagement, even as the company still recommends manual review for production-critical changes. That's a difficult balance to strike in practice — the less involved developers are day-to-day, the less context they have when something does need a human judgment call. Anthropic's own numbers, showing human reviewers catching only 13.6% of dangerous commands manually, arguably make the case for automation, but they also underscore how much trust is now being placed in the classifier's judgment rather than a person's.