Auto Mode will soon be the default in Claude Code — because humans can’t be trusted

Anthropic's Claude Code is set to have auto mode as the default option starting August 14, aiming to alleviate the annoyance and danger users currently face when approving every coding action. Originally, users would have to manually decide whether to approve or disregard each command, leading to a high approval rate of 97% and only 13.6% of dangerous commands caught by humans.

In contrast, Claude Code in auto mode successfully caught 89% of dangerous commands. As sessions progressed, human testers found fewer dangerous commands, stopping at 5% after 50 prompts, indicating that constant permissions prompted reduced engagement. To address this, auto mode now blocks dangerous commands without asking for permission, and after three consecutive blocks or twenty in a single session, it reverts to manual approvals.

Anthropic has also fortified auto mode by introducing hard denies for actions like data exfiltration, which require developers to switch out of auto mode or manually run the command. Moreover, the classifier now checks the destination of git push or pull requests to determine if they are public, private, or trusted before execution.

It also scans code pulled from web pages or tool outputs for prompt injection attempts. To validate these enhancements, Anthropic conducted a two-week red-teaming pilot with Apollo Research, reducing the number of detected attacks from 12% to 7%. Anthropic compares this to OpenAI's GPT-5.6 Sol in Codex, which let through 19% of attacks in full access mode.

While auto mode doesn't guarantee safety, it significantly reduces risk, especially for high-stakes changes to production infrastructure where a human should still be monitored. Additionally, Claude Code sessions can now communicate with each other, streamlining collaboration on related tasks by sharing summaries without repeating histories or files.