Anthropic announced on August 7, 2026 that auto mode is becoming the default in Claude Code for Pro, Max, and Team plans, with the change taking effect on August 14. Instead of asking for approval on every action, the tool routes tool calls through a classifier that blocks irreversible or out-of-scope operations.
Key takeaways
- Auto mode becomes the default in Claude Code for Pro, Max, and Team plans on August 14, 2026.
- A classifier blocks irreversible, destructive, or out-of-scope actions instead of prompting for approval.
- In a test with 1,053 paid testers, auto mode caught 89% of dangerous commands versus 13.6% for human review.
- Independent evaluation by Trajectory Labs: none of 720 prompt injection attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5.
- Anthropic stops charging for the classifier tokens on these plans.
What auto mode does
Until now, Claude Code paused and asked the user for approval on every sensitive operation — writing a file, running a terminal command, calling a tool. Auto mode replaces that mechanism with a classifier that evaluates each tool call and lets it through, blocks it, or looks for a safer alternative. It asks for approval only when it cannot decide on its own.
For each tool call, the classifier picks one response:
Anthropic says nearly the entire company already uses auto mode. The change covers the Pro, Max, and Team plans, and users can still switch back to manual approval in settings. It fits a broader trend among coding agents that reduce the number of prompts in favor of more autonomy.
Safety and testing
The company bases the decision on several tests. In a controlled experiment with 1,053 paid testers, human review caught just 13.6% of dangerous commands, while auto mode caught 89%. That inverts the intuition that a human watching every action is safer than an automated check, because constant approval leads to reflexive clicking of “yes”.
A separate evaluation was run by Trajectory Labs, which tested indirect prompt injection attacks. According to Anthropic, none of the 720 attempts got through auto mode on Claude Fable 5, Opus 5, and Sonnet 5. At the same time, the company stops charging for the extra tokens the classifier consumes on the Pro, Max, and Team plans.
Not everyone is convinced about the prompt injection protections.
I absolutely buy that auto mode is a better solution than asking humans to constantly approve actions.
Simon Willison, software developer and AI blogger.
Willison adds, however, that on prompt injection resistance he would like independent confirmation, and notes that malicious third-party packages could still bypass the protections. He says he would gladly be proved wrong by the end of 2026.
Why it matters
The change touches a fundamental tension in AI agents — between control and convenience. Constant approval prompts are tiring and in practice lead to rubber-stamping, which is itself a security hole. Anthropic argues that a well-trained classifier errs less often than a fatigued human. If the numbers hold, that shifts the baseline for the whole category of tools. The risk is real, though, because an automated system deciding on its own moves responsibility from the user to the model and its maker, and prompt injection remains an open problem.
What's next?
- Auto mode becomes the default on August 14, 2026 for the Pro, Max, and Team plans, per the Anthropic blog.
- Pro, Max, and Team users can switch back to manual approval in settings.
- Simon Willison is waiting for independent confirmation of auto mode's prompt injection resistance by the end of 2026.
Sources
- Anthropic — Auto mode is now the default in Claude Code for Pro, Max, and Team plans
- Simon Willison’s Weblog — Auto mode is now the default in Claude Code for Pro, Max, and Team plans
