Claude Code Turns Auto Mode On by Default: What Changes 14 August

What changes on 14 August

Anthropic confirmed the switch in a blog post on 7 August: from 14 August 2026, auto mode is the default permission mode for new Claude Code sessions on Pro, Max and Team plans. Instead of pausing for approval before each tool call, Claude routes every action through a classifier and proceeds unless the action is judged "irreversible, destructive, or aimed outside your environment". When something is blocked, Claude looks for a safer alternative or asks you directly.

• Who is affected — Pro, Max and Team plans, new sessions only. Enterprise, the Claude API and sessions on AWS Bedrock, Google Cloud's Agent Platform and Microsoft Foundry stay opt-in for now; Anthropic says those will transition within about a month.
• Existing preferences survive — if you already set a default mode yourself, it stays unless you accept a one-time switch prompt. Defaults pinned by an organisation through managed settings do not change at all.
• The escape hatch is one keystroke — Shift+Tab in the CLI, or the mode dropdown in the desktop app, switches modes mid-session.
• No extra cost — Anthropic says Pro, Max and Team users are not charged for the classifier overhead.

If this feels sudden, it is not. Auto mode has been rolling towards default status for months, and we covered the direction of travel when autopilot behaviour first landed in Claude Code earlier this year. What is new is that the ordinary paid tiers now get agent-first behaviour out of the box.

The new blast-radius rules: old versus new

The mental model shifts from "approve each step" to "define the boundary once". The classifier is a second gate that runs after the existing permissions system: your explicit deny and ask rules are evaluated first and still block or prompt regardless of what the classifier thinks. By default the classifier trusts only the working directory and the current repository's configured remotes — pushing to another org's repo or writing to a cloud bucket is treated as leaving your environment until you say otherwise.

Anthropic has also added what it calls data-aware rules: the classifier distinguishes secrets from ordinary strings, and checks a repository's visibility before allowing pushes so confidential material does not land in a public repo. Git status checks run before destructive commands to prevent accidental loss of uncommitted work.

The numbers behind the decision

Anthropic's argument is blunt: humans are bad at reviewing permission prompts. In a controlled study of 1,053 paid developers, participants caught only 13.6 per cent of deliberately injected dangerous commands, while auto mode blocked 89 per cent. Anthropic's own telemetry, cited in the same post, shows users approve 97 per cent of permission prompts — habituation, not review. Anthropic also reports that in real-world sessions, production-level harm showed up 2.6 times more often in manually approved sessions than in auto-mode ones (6.3 per cent versus 2.4 per cent).

An independent evaluation adds weight: Simon Willison's write-up cites third-party testing of 72 indirect prompt-injection scenarios — 720 attempts in total — with zero successful attacks against current Claude models running in auto mode. That is a striking result given how routinely coding agents have been breached by a single planted comment in earlier red-team work, and it will not settle the argument on its own: benchmarks like AgentRedBench's 215 authorisation attacks keep finding new failure classes as fast as vendors close old ones.

Boris Cherny, who leads Claude Code, said the team has been using auto mode exclusively and could not imagine going back to permission prompts, per TechCrunch.

How to opt out — or keep a human checkpoint

Nobody is locked in. Your options, from lightest to firmest:

• Switch modes ad hoc — Shift+Tab in the CLI or the desktop mode dropdown, any time.
• Keep your own default — decline the one-time switch prompt and your existing default stays.
• Pin it organisation-wide — admins set defaultMode in managed settings, or disable the feature entirely with disableAutoMode.
• Keep auto mode but gate the risky bits — content-scoped permissions.ask rules are evaluated before the classifier and always force a prompt, even in auto mode.

That last option is the one most teams should reach for. This snippet keeps auto mode on for everything except pushes and pull requests:

{
  "permissions": {
    "ask": [
      "Bash(git push *)",
      "Bash(gh pr create *)"
    ]
  }
}

Beyond that, the auto-mode configuration reference exposes an autoMode settings block: environment declares your trusted repos, buckets and domains in plain English; hard_deny, soft_deny and allow override the built-in rule lists; and claude auto-mode defaults, config and critique let you inspect and sanity-check the effective rules.

What UK and Indian teams should do before Friday

Whether you run a four-person startup in Bengaluru or a platform team inside a London bank, the same week-one checklist applies:

1. Decide your posture now — accept the default, pin manual mode, or adopt auto mode with ask-rule checkpoints. Do not let each developer discover the change independently on Friday morning.
2. Move personal autoMode config to user settings — the classifier deliberately ignores project-level .claude/settings.json and .claude/settings.local.json, so a checked-in repo cannot inject its own allow rules. Anything in those files belongs in ~/.claude/settings.json.
3. Declare your trusted infrastructure — add your source-control org, internal domains and CI services to autoMode.environment, otherwise routine pushes to company repos get blocked as potential exfiltration.
4. Add ask rules for your genuinely irreversible actions — deploys, migrations, anything touching production namespaces.
5. Put org-wide boundaries in managed settings — a developer can extend the allow list but cannot remove entries your organisation distributes; for actions that must never run, use permissions.deny, which blocks before the classifier is even consulted.
6. Review denials weekly — the /permissions dialog records recent classifier blocks; repeated denials for the same destination usually mean a missing environment entry, not a threat.

The governance question

For regulated teams the shift is less about safety statistics and more about accountability. When a human approves each step, the audit trail is legible; when a classifier approves on your behalf, your governance story has to move up a level — from "who clicked yes" to "what boundary did we define, and who owns it". UK firms working under FCA operational-resilience expectations and Indian teams handling personal data under the DPDP Act should treat the autoMode settings block as a policy document, version it, and put it through the same review as any other access-control change. This lands in the middle of a broader trend we have tracked, where agent identity and non-human-access governance have become hiring categories in their own right.

It is worth being honest about the counter-argument too: an 89 per cent block rate still means the classifier missed roughly one in nine injected dangerous commands in Anthropic's own study. Anthropic's position is that this is far better than the 13.6 per cent humans managed — almost certainly true — but "better than habituated clicking" is not the same as "safe to ignore". The hard-deny layer for exfiltration, plus your own deny rules, is what turns a good average into an acceptable worst case.

What this means for Builders shipping with agents

For working Builders, the significance is competitive as much as technical. Once the default tool on a Pro plan runs unattended, the differentiator stops being "can you drive a coding agent" and becomes "can you design the boundary it runs inside". Expect interview questions in both markets to shift accordingly: what goes in hard_deny, when to use permissions.ask versus a conversational instruction, how to scope trusted infrastructure for a multi-repo estate. If you are choosing tooling this quarter, our comparison of the Cursor and Claude Code production stacks is a sensible starting point — and note that auto mode arrives on top of Sonnet 5 already being the Claude Code default, so the out-of-the-box experience on 14 August is a materially more autonomous product than the one many teams evaluated even three months ago.

The pragmatic take: try auto mode on a low-stakes internal repo this week, with the push/PR ask rules above, and measure how often the classifier blocks you. If the denial log is quiet after a fortnight, widen the boundary. If it is noisy, you have learnt something about your environment definition — either way, you are making the decision on evidence rather than defaults.