AI coding agents have spent years asking humans for permission.
Anthropic now argues that the humans may be the weak point.
Starting August 14, new Claude Code sessions for Pro, Max, and Team subscribers will run in auto mode by default, allowing the coding agent to execute most tool calls without stopping for individual approval. Instead, Claude Code will use a classifier to intervene when an action appears irreversible, destructive, or directed outside the user's environment.
The change is less about removing oversight than changing where that oversight happens. Rather than asking developers to evaluate a stream of command-level prompts, Anthropic is putting more responsibility on an automated safety layer designed to recognize the actions users are most likely to regret.
Anthropic detailed the change in its August 7 Claude Code announcement.
Permission Fatigue Is Driving the Default Switch
Permission prompts are supposed to keep autonomous software under control. Anthropic's usage data suggests they may stop working when developers see enough of them.
Claude Code users approve 97% of permission prompts, according to Anthropic. The rejection rate for individual permission requests is just 3%, even though users reject 39% of plans presented by Claude for approval.
The difference matters.
Developers appear willing to question what an agent proposes at the planning stage, but much less likely to scrutinize every command once the work is underway.
Anthropic found similar behaviour in configuration settings. As of June, 49.5% of active Claude Code CLI users had created a Bash allow rule. Another 62% had either used bypassPermissions or selected the equivalent of "don't ask again" for Bash commands, while one-quarter of interactive sessions were already starting in bypass-permissions mode.
Those patterns complicate the assumption that repeated human confirmation automatically creates a safer system.
As AI coding agents take on longer and more complex assignments, developers can face dozens or hundreds of permission decisions in a single project. An approval mechanism that becomes routine can turn into another click rather than a meaningful security check.
The Classifier Now Sits Between Claude and the Shell
Auto mode takes a different approach.
Each relevant tool call is evaluated by a classifier before execution. Routine actions can proceed without interruption. Commands considered destructive, irreversible, or directed outside the local environment can be stopped.
When a command is blocked, Claude can attempt a safer approach or ask the user for approval. If the system encounters three consecutive blocks or 20 blocks during a session, Claude Code falls back to manual permission requests.
Anthropic has also added hard-deny controls for actions that organizations may never want automatically authorized. Data exfiltration is one example. Administrators can add their own hard-deny rules through managed settings.
The classifier receives additional context before making some decisions. It can check repository visibility before a push, inspect Git status before potentially destructive Git operations, and distinguish between destinations that are public, private, or trusted. External web pages, files, and tool outputs can also be screened for prompt-injection attempts before their contents reach Claude.
That architecture reflects the wider shift toward longer-running agentic workflows, where a model may execute many connected actions before a developer returns to review the finished work.
Stopping for every command works against that model of software development.
Anthropic's Safety Data Challenges Manual Approval
Anthropic's strongest argument for the change comes from a controlled study involving 1,053 paid professional testers.
The team and I use Auto mode exclusively, and have been for many months. I couldn't imagine going back to permission prompts! Really excited to get this out to everyone. https://t.co/rH6qc6hqyT
— Boris Cherny (@bcherny) August 7, 2026
During the experiment, researchers replaced one normal permission request in each test session with a clearly dangerous command. Participants caught and rejected the dangerous command 13.6% of the time.
Auto mode blocked 89% of those same commands.
The difference became larger during longer sessions. Human participants blocked roughly 17% of dangerous commands early in a session, but that figure fell to around 5% after they had already encountered 50 or more permission prompts. Auto mode's blocking rate remained stable, according to Anthropic.
Production-session analysis produced a similar pattern. Among sessions Anthropic's safety systems had already flagged for review, 6.3% of manually approved sessions contained an unintended harmful action rated at production-level severity or above. The rate for auto mode sessions was 2.4%. The dataset covered accounts that had opted into data use for training and analysis.
These numbers come from Anthropic's own research and should be read in that context. The company also commissioned third-party adversarial testing and says its classifier improved after researchers identified attack paths.
Anthropic is not claiming the classifier eliminates risk. Its documentation specifically recommends human review for high-stakes changes to production infrastructure.
That distinction becomes important as more powerful Claude models support increasingly autonomous enterprise AI deployments.
Enterprise Users Get More Time Before the Default Changes
The August 14 switch does not apply everywhere at once.
Pro, Max, and Team users without another default permission mode configured will begin new sessions in auto mode. Users who previously selected a different default may receive a one-time prompt asking whether they want to switch, while pinned defaults remain unchanged.
Claude Enterprise, the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry will continue using auto mode on an opt-in basis initially.
Anthropic says it plans to make auto mode the default across those environments in the following month while coordinating with its cloud partners. Enterprise administrators can already make auto mode their organizational default or disable it through managed settings.
Anthropic is also removing the token cost associated with the auto mode classifier for Pro, Max, and Team subscribers. The classifier consumes a small number of additional tokens on each tool call, but users on those plans will no longer be charged for that overhead.
The staged rollout gives larger organizations additional time to evaluate security policies before autonomous execution becomes the standard configuration.
Coding Agents Are Being Built to Run Without an Audience
The productivity case for auto mode depends on letting Claude work for longer periods without someone watching every action.
Anthropic reports that Team and Enterprise adopters using auto mode produce about 25% more pull requests. Adobe, Nuro, Gusto, and Garner Health are among the organizations already using the mode as a production default.
That fits a broader change in how coding models are being designed. Recent Claude AI agent releases have increasingly emphasized extended execution, tool use, parallel work, and safeguards capable of operating while the user is absent.
For development and marketing technology teams, the practical change is straightforward: workflows built around Claude Code may require fewer command-by-command approvals, but organizations still need explicit controls around credentials, production infrastructure, public repositories, sensitive customer information, and deployment permissions. Auto mode changes the approval layer; it does not replace access control, code review, testing, or deployment governance.
Anthropic's August 14 rollout turns that model from an optional workflow into the standard experience for a large portion of Claude Code's paid user base. Enterprise and API environments remain outside the default rollout for now, with their transition scheduled separately.
