The Default Changed, the Switch Is Still There
Sessions started after August 14 run in auto mode: every tool call passes through a classifier meant to block anything irreversible, destructive, or aimed outside your working environment. When something is blocked, Claude usually finds a safer path or asks, and repeated blocks drop the session back to manual approval. Existing deny rules and explicit ask rules still evaluate ahead of the classifier. Anyone who has set their own default gets a one-time prompt, pinned defaults are untouched, and Shift+Tab still switches modes at any point.
The Argument Is a "Humans Are Worse at This" Number
Anthropic ran a study with 1,053 paid testers in which one permission prompt was swapped for an obviously dangerous command — text only, never executed. Testers noticed it just 13.6% of the time, falling to roughly 5% later in long sessions, while the classifier caught 89%. Anthropic also reports that teams on auto mode ship about 25% more pull requests. On prompt injection, Anthropic commissioned Trajectory Labs to run 72 indirect injection scenarios ten times each; none of the 720 attempts succeeded against Claude in auto mode, while GPT-5.6 Sol in Codex let 19% through in full access mode in the same evaluation. Two caveats are worth keeping in view: the evaluation was commissioned by the vendor, and it tested the versions available on July 17, 2026. The extra tokens the classifier spends per tool call are no longer billed to Pro, Max, and Team users, effective immediately.
Whether to Accept the New Default
Anthropic states the limit plainly: the classifier reduces risk without eliminating it, and human review is still recommended for production changes. That makes this a per-environment decision. For local development and one-off scripts, accepting the default saves a great deal of clicking. For sessions wired to a production database, deployment credentials, or a CI pipeline, pin your own permission mode rather than letting a default decide for you. Claude Enterprise, the Claude API, and the versions on AWS, Bedrock, Google Cloud, and Microsoft Foundry stay opt-in for now, with Anthropic saying it plans to make auto mode the default there within a month — so administrators still have time to evaluate.
via: Anthropic announcement: Auto mode is now the default in Claude Code, Claude Code docs: Configure auto mode, 9to5Mac report; verified 2026-08-10