Claude Code makes auto mode the default for coding tasks

Anthropic is done pretending most developers read every shell prompt. Per the Claude Code blog, auto mode becomes the default on Pro, Max, and Team plans starting August 14, routing each tool call through a permission classifier instead of a click-through wall. Classifier overhead tokens are waived for those plans effective today. Permission fatigue just lost the product argument.

What flips on August 14

New sessions on Pro, Max, and Team start in auto mode. Users who already set a different default may see a one-time switch prompt. A pinned default stays pinned. Enterprise, the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud’s Agent Platform, and Microsoft Foundry stay opt-in for now, with Anthropic saying it plans to default those surfaces within a month and stop charging classifier overhead there too. Enterprise admins can force the default earlier through managed settings.

The operational win is longer unattended runs. Anthropic pitches auto mode as what makes long-horizon models like Claude Opus 5 practical for multi-hour tasks. Among Teams and Enterprise adopters, it claims auto mode users ship about 25% more PRs. Customer names in the post: Adobe, Nuro, Gusto, and Garner Health already run it as a production default.

How the permission classifier works

Instead of prompting on every tool call, auto mode sends each call through a classifier aimed at irreversible, destructive, or out-of-environment actions. A block usually triggers a safer path or an explicit ask. Three blocks in a row, or twenty in a session, fall back to manual approvals. Broad Bash allow-rules that amount to arbitrary code execution (think python:*) are set aside in auto mode so they cannot skip the classifier; settings files are not rewritten.

Anthropic’s rationale starts with behavior data. Users approve 97% of Claude Code permission prompts, while rejecting 39% of plan-approval dialogues. As of June 2026, 49.5% of active CLI users have a Bash allow-rule, and 62% have used bypassPermissions or “don’t ask again” on Bash. The old UX trained people to click Yes.

Claimed safety gains vs manual approve

In a controlled test with 1,053 paid professional testers, humans caught 13.6% of dangerous commands; auto mode caught 89%. Humans got worse as sessions lengthened. Auto mode’s block rate stayed flat. In flagged real sessions (May–June 2026, training-opt-in accounts), production-severity unintended harm showed up in 6.3% of manually approved sessions versus 2.4% under auto mode.

Third-party work is part of the pitch. Apollo Research’s synthetic-attack pilot helped harden the classifier; Anthropic says held-out miss rate fell from 12% to 7% after fixes. A Trajectory Labs prompt-injection eval reported zero successful attacks against Claude Fable 5, Opus 5, or Sonnet 5 under auto mode, versus a 5.83% attack success rate for GPT-5.6 Sol in Codex Auto-review in that harness. Vendor-commissioned numbers. Read them as Anthropic’s case, not gospel.

Who can still opt out

Shift+Tab in the CLI, or the desktop mode dropdown, still switches modes. Admins can pin defaultMode in managed settings or kill auto mode with disableAutoMode. Enterprise and cloud-platform users remain opt-in until the promised follow-on default. Anthropic’s own caveat is the one worth keeping: classification does not erase risk, and high-stakes production infra still wants human eyes.

Analysis: this is Anthropic admitting the approve button became theater. If the classifier holds under real exfiltration and destroy-the-cluster prompts, auto mode is the first coding-agent UX that treats “user will rubber-stamp” as the baseline threat model. If it fails loud in the wild, August 14 becomes the week a lot of teams rediscover manual mode.