Claude Code Makes Auto Mode Default Starting August 14

Starting August 14, 2026, Claude Code will run in Auto Mode by default for every Pro, Max, and Team plan user — no opt-in required. Anthropic says the switch follows internal telemetry showing manual approval was already failing: developers reflexively approved 97% of all permission prompts, turning the review step into a formality rather than a safeguard.

The data behind the switch

Anthropic ran a controlled study with 1,053 paid professional testers, swapping a routine permission prompt for a clearly dangerous command mid-session without telling testers what was being measured. Human testers caught the dangerous command only 13.6% of the time (143 out of 1,053). Auto Mode's classifier blocked 89% of the same commands (937 out of 1,053) — and blocked 800 dangerous commands a human had already approved, while humans caught only 6 that Auto Mode missed. Human vigilance also degraded with session length: testers blocked about 17% of dangerous commands early on, falling to roughly 5% after 50-plus prior prompts. Auto Mode's detection rate stayed flat regardless of session length.

A separate analysis of real, opted-in production sessions flagged between May and June 2026 found that 6.3% of manually approved sessions contained a harmful action the user hadn't explicitly asked for, at a production-level severity threshold, versus 2.4% of Auto Mode sessions.

Auto Mode vs. Codex on prompt injection

Anthropic also tested Auto Mode against prompt injection with third-party firm Trajectory Labs, running 720 attack attempts across 72 scenarios against the latest public versions of Claude Code and Codex as of July 17, 2026.

Agent / mode	Attack success rate
Claude Fable 5 / Opus 5 / Sonnet 5, Auto Mode	0%
Codex, "Auto-review" mode	5.83%
Codex, unrestricted "Full Access" mode	19.03%
Claude models, bypassPermissions mode	0.09%

Anthropic frames the bypassPermissions figure as a reminder that the classifier — not the base model alone — is doing the heavy lifting.

What ships alongside the default change

• Hard denies: actions like data exfiltration sit in a category the classifier is designed to never approve, and security teams can add their own org-wide hard-deny rules.
• Data destination checks: before a git push or pull request runs, the classifier checks whether the destination is public, private, or trusted.
• Git-status awareness: before a destructive command like git reset --hard, the classifier checks the repository's current git status first.
• Prompt injection screening: an API-side probe scans content Claude pulls from web pages, files, or tool outputs, and flags a warning before it reaches the user.

Pro, Max, and Team users pay nothing extra for the classifier's token overhead. Enterprise, Claude API, and cloud-platform users stay opt-in for now — Anthropic says it plans to extend the default and the fee waiver there "in the coming month." Broad Bash allow-rules that grant arbitrary code execution are automatically paused while Auto Mode is active, since they'd let commands skip the classifier entirely.

The productivity number, and the pushback

Anthropic's headline figure for engineering leads: teams using Auto Mode ship about 25% more pull requests than teams on manual approval, based on data from Team and Enterprise adopters. Claude Code lead Boris Cherny posted on X that he and the team "use Auto mode exclusively, and have been for many months," adding, "I couldn't imagine going back to permission prompts."

Not everyone is convinced the security case is closed. Developer and LLM researcher Simon Willison, who covered the announcement the same day, pointed out that 89% detection still leaves 11% of dangerous commands uncaught, and argued the harder problem isn't accidental destructive actions but prompt injection — what he calls the "lethal trifecta" of private data access, exposure to untrusted content, and the ability to exfiltrate. He said he'd like independent verification of the zero-successful-attacks claim before fully trusting it.

What to watch

Enterprise, API, and cloud-platform users remain opt-in for now, with no exact date beyond "the coming month." Teams not ready to flip the switch on August 14 can pin a different default via managed settings before then — anyone already using a custom default gets a one-time in-app prompt, and ignoring it keeps the existing setting. Anthropic still recommends manual review for high-stakes production changes, classifier or not.