Anthropic is removing a step most developers were skipping anyway. Starting August 14, Claude Code will run in auto mode by default for Pro, Max, and Team plan users, cutting back the steady stream of permission prompts that ask developers to approve each action the AI agent wants to take.

The company first tested auto mode back in March, framing it as a middle ground between speed and control. Instead of stopping to ask permission for every command, auto mode routes each tool call through a classifier that only interrupts when an action looks irreversible, destructive, or aimed outside the user’s own environment. Everything else runs without a pause.

The timing tracks with a pattern Anthropic says it’s seeing across its own usage data: People don’t actually review most permission prompts. According to the company’s blog post announcing the change, users approve 97% of permission requests in Claude Code. That’s not evidence people are carefully checking each command. It’s evidence they’ve stopped reading them.

Anthropic backs this up with numbers from a controlled study of 1,053 paid testers. Partway through each coding session, researchers swapped in a genuinely dangerous command disguised as a routine permission prompt. Human reviewers caught it 13.6% of the time. Auto mode caught it 89% of the time. The gap widened as sessions ran longer — human catch rates dropped to around 5% after 50 or more prior prompts, while auto mode’s detection rate held steady no matter how long the session ran.

“A 13.6% catch rate tells you per-action approval stopped working long before anyone turned it off,” said Mitch Ashley, VP and practice lead for software lifecycle engineering and AI-native software engineering at The Futurum Group. “Teams counted clicks because clicks were easy to count. Nobody measured whether the click caught anything.”

Anthropic paired that testing with real production data. Looking at flagged sessions from May and June, the company found that sessions using manual approval contained serious unintended harm more than twice as often as auto mode sessions — 6.3% versus 2.4% at production-severity levels, like accidentally deleting rows from a live database.

The company also ran auto mode through adversarial testing with Apollo Research, an AI safety firm, injecting synthetic attacks into real coding trajectories. After a find-fix-verify cycle, auto mode’s miss rate on a held-out attack set dropped from 12% to 7%. A separate third-party evaluation from Trajectory Labs tested 72 prompt injection scenarios against Claude Code and OpenAI’s Codex. None of the 720 attack attempts succeeded against Claude Code running auto mode. Codex’s comparable auto-review mode had a 5.83% success rate on the same attacks.

None of this means auto mode approves everything. Anthropic built in specific guardrails it calls hard denies — data exfiltration, for instance, is a category the classifier is designed to never approve, full stop. The classifier also checks git status before destructive commands like git reset –hard, distinguishes between public and private repositories before allowing pushes, and screens content pulled from external sources for prompt injection attempts. If the classifier blocks something three times in a row, or twenty times across a session, Claude Code drops back into manual approval mode.

There’s a productivity angle here too. Anthropic says teams using auto mode ship about 25% more pull requests than those using manual review. Nuro, one of the companies quoted in Anthropic’s announcement, described kicking off an agent at 10 p.m. and getting three finished PRs by morning — something that wasn’t realistic under a model that stopped for permission at every step. Adobe, Gusto, and Garner Health are also running auto mode as their production default, with Garner pushing it to all 550 employees through managed settings.

That shift doesn’t remove the human from the process. It moves them earlier. “Human in the loop isn’t scalable and must become human engineering the loop, with the person defining what an agent may touch before the session starts,” Ashley said. “Teams still owe auditors a record of what ran unattended and why.”

For now, the change only applies to Pro, Max, and Team plans. Auto mode stays opt-in on Claude Enterprise, the Claude API, and the major cloud platforms — AWS, Google Cloud, and Microsoft Foundry — giving admins time to evaluate it before Anthropic plans to flip the default there too within the next month. Enterprise admins who want to move now can already set auto mode as the default through managed settings.

Anthropic is also dropping the token surcharge tied to the classifier’s overhead for Pro, Max, and Team users, effective immediately. Users who’ve already set a different permission mode manually won’t be switched automatically — they’ll get a one-time prompt asking if they want to opt in.

Claude Code Head Boris Cherny put it plainly in a post on X: He and his team have used auto mode exclusively for months and don’t want to go back to permission prompts. Anthropic’s data suggests that’s less an endorsement than a description of what happens to most users’ vigilance over time anyway — the company is just betting that a classifier trained on it does the job better than tired humans clicking “approve.”