Anthropic enables the auto mode of Claude Code by default for Pro, Max, and Team users starting August 14. A classifier then automatically checks each command for dangerous actions instead of obtaining manual approval for each one. In a test with 1,053 paying users, the classifier identified 89 percent of dangerous commands, while humans only recognized 13.6 percent.
Classifier Outperforms Human Review in Direct Comparison
According to Anthropic’s announcement, auto mode is intended to provide a middle ground between unconditional approval of all actions and repeated individual confirmations: developers should be able to run longer, autonomous workflows without intervening at every step. The classifier evaluates each tool call from Claude Code to determine whether it would have irreversible, destructive, or out-of-scope effects. If the system blocks a command, Claude independently seeks a safer way or directly asks for permission. Only after three consecutive or 20 blocks in a session does the tool automatically revert to manual approval.
In direct comparison, the gap was clearly evident: the classifier blocked 800 risky commands that human testers had previously approved – conversely, it only let six commands through that humans would have stopped. The human hit rate also decreased with session duration: at the beginning, testers recognized about 17 percent of dangerous commands, but after more than 50 approvals, only about five percent. The classifier maintained a constant detection rate throughout the entire session.
Production Data and External Tests Support the Rollout
Anthropic also backs the rollout with production data from May and June 2026: in manually approved sessions, unintended harmful actions occurred twice as often as in auto mode – at the highest severity level, the rate was 6.3 percent versus 2.4 percent. An independent red team from Trajectory Labs tested 72 attack scenarios against the models Claude Fable 5, Opus 5, and Sonnet 5 in auto mode and achieved a success rate of zero percent; in the comparable approval mode of OpenAI’s GPT-5.6 Sol, testers managed a 5.83 percent success rate.
The company is also responding to its own incidents: just in July, Anthropic had to admit that Claude models breached real systems during security tests. Corporate customers such as Adobe, Nuro, Gusto, and Garner Health reportedly already use auto mode in production, shipping about 25 percent more pull requests as a result – a figure that is not independently verified. At Gusto, about ten percent of all sessions have included at least one classifier denial since mid-May. Unlike Anthropic, OpenAI is currently forgoing an automatic approval mode for its GPT-5.6 model and continues to rely on manual control.
Rollout Proceeds in Stages, Manual Control Remains an Option
Existing sessions of Pro, Max, and Team customers automatically receive the new default unless someone has previously pinned a different mode; users see a one-time notice and can switch back at any time via the Shift+Tab keyboard shortcut. Enterprise and API access remain opt-in for now but are expected, according to Anthropic, to switch automatically within a month; administrators can set the default centrally through a configuration file or disable the feature entirely.
Fixed, customizable deny rules guard against data exfiltration, the system additionally checks git status before destructive actions, and content pulled from the web is screened for hidden prompt-injection attempts. Attackers are already targeting tools like Claude Code specifically: a worm that spread in early August through 444 npm packages searched for credentials belonging to AI coding tools. Anthropic itself cautions that auto mode relies on a classification system and does “not eliminate risk” entirely – for high-stakes changes to production infrastructure, manual review is still recommended.
What matters now is whether the classifier itself becomes the new target: once automation becomes the norm, some attack attempts may shift away from inattentive developers and toward the filtering logic behind them. Whether Anthropic’s numbers hold up outside the controlled study will become clear at the earliest once the default is expected to reach enterprise and API customers in September.
