Table of Contents
Anthropic is changing how Claude Code handles permissions by making auto mode the default for new sessions on Pro, Max and Team accounts from August 14, 2026.
Rather than repeatedly asking developers to approve individual tool actions, Claude Code will use a proprietary classifier to evaluate tool calls. The system is designed to allow routine operations while intervening when an action appears irreversible, destructive or outside the user’s environment.
Anthropic says the change is intended to address confirmation fatigue, where users become accustomed to approving repeated permission requests without carefully reviewing them.
Why Anthropic Is Changing the System
According to Anthropic, users approve around 97% of permission prompts in Claude Code.
The company says this high approval rate suggests that repeated prompts can become routine rather than meaningful safety checks.
Internal data also showed that by June, 62% of users had attempted to bypass permissions or selected “don’t ask again” for Bash commands. In addition, 49.5% of active CLI users had created a Bash allow rule.
Anthropic says these patterns contributed to its decision to rely more heavily on automated assessment.
How Auto Mode Works
In auto mode, a classifier evaluates individual tool calls made by Claude Code. Routine operations can proceed without repeated confirmation, while potentially dangerous actions can trigger intervention.
If an action is blocked, Claude can attempt a safer alternative or request explicit authorization.
The objective is not to eliminate permission controls but to make them more selective and meaningful.
| Features | Details |
| Default rollout | August 14, 2026 |
| Accounts | Pro, Max and Team |
| Applies to | New sessions |
| Routine actions | Can proceed automatically |
| High-risk actions | May require approval |
| Enterprise/API | Remain opt-in |
Anthropic’s Security Testing
Anthropic tested auto mode with 1,053 paid participants, placing a deliberately dangerous command among normal permission prompts.
Auto mode blocked 89% of the planted commands, while human participants rejected only 13.6%. Anthropic also found that human vigilance declined during longer sessions, with refusal rates falling to roughly 5% after 50 or more prompts.
The company says these results demonstrate the potential problem with relying on repeated manual approvals.
However, the findings should not be interpreted as proof that auto mode is universally safer. The experiment was controlled and used deliberately planted commands.
Remaining Risks and Safeguards
The initial test produced an approximately 11% miss rate, meaning some dangerous commands were not blocked.
A separate adversarial evaluation conducted with Apollo Research reported a 7% miss rate after classifier improvements. Anthropic noted that this was based on a deliberately hostile dataset rather than normal real-world usage.
The company also commissioned Trajectory Labs to test indirect prompt injection. None of the 720 attacks tested against Claude Fable 5, Opus 5 and Sonnet 5 in auto mode succeeded in that evaluation.
However, controlled tests cannot guarantee protection against every future attack, including potential supply-chain techniques involving malicious third-party packages.
Claude Code also retains additional guardrails. Three consecutive denials or 20 total denials during an interactive session can return the relevant tool to manual approval mode. Headless sessions terminate instead.
Teams can also configure approval rules for sensitive actions, such as pushes or pull requests, as well as deny rules for prohibited operations.
Boris Cherny Supports Auto Mode
Boris Cherny, head of Claude Code, said his team has used auto mode exclusively for many months and that he could not imagine returning to the previous permission-prompt workflow.
His comments reflect Anthropic’s confidence in the new system, although they represent the team’s experience rather than independent proof of its security.
What Developers Should Know
Pro, Max and Team users will not face a separate charge for the relatively small token overhead associated with the classifier, according to Anthropic.
Enterprise, API and platform deployments through Amazon Web Services, Google Cloud and Microsoft Foundry remain opt-in while Anthropic prepares a broader rollout.
For developers, the change should mean fewer interruptions during everyday coding tasks while retaining safeguards around higher-risk operations.
Key Takeaways
- Claude Code auto mode becomes the default for new Pro, Max and Team sessions from August 14.
- Users currently approve about 97% of permission prompts, according to Anthropic.
- Auto mode blocked 89% of planted dangerous commands in one controlled test.
- A separate adversarial evaluation reported a 7% miss rate after improvements.
- Three consecutive or 20 total denials can trigger a return to manual approvals.
- Enterprise, API and certain cloud deployments remain opt-in.
- Anthropic says Pro, Max and Team users will not pay an additional token charge for the classifier.
Frequently Asked Questions
What is changing in Claude Code?
Auto mode will become the default for new sessions on Pro, Max and Team accounts from August 14, 2026.
Why is Anthropic making this change?
The company says frequent permission approvals can cause confirmation fatigue, reducing the effectiveness of manual review.
Does auto mode remove security controls?
No. Riskier operations can still be blocked or require authorization, while teams can configure additional restrictions.
Is auto mode completely secure?
No. Anthropic’s tests show that the classifier can miss some dangerous actions, and controlled evaluations cannot guarantee protection against every attack.
Conclusion
The move to default auto mode represents a significant change in Claude Code’s permission system. Anthropic is attempting to reduce confirmation fatigue by shifting routine decisions to an automated classifier while preserving additional safeguards for sensitive operations.
The testing results suggest automated review can outperform fatigued users in certain controlled scenarios, but the reported miss rates show that the system is not infallible.
For developers, the change promises a smoother workflow with fewer interruptions while keeping configurable protections for higher-risk tasks.