Anthropic said this morning that Claude Code will start new sessions in auto mode from August 14, 2026 on the Pro, Max and Team plans. Instead of asking you to approve each eligible tool call, Claude Code routes the call through a classifier that decides whether it runs, stopping only for actions it reads as irreversible, destructive, or aimed outside your environment.

The case Anthropic makes is not that the classifier is flawless. It is that the thing being replaced, a human tapping "yes" a few dozen times an hour, stopped functioning as a check some time ago.

RelatedQwen3.8-Max lands at 2.4T with no benchmark table

  • When: August 14, 2026 for Pro, Max and Team. Enterprise and API accounts stay opt-in, with the default reaching them in the coming month.
  • What it replaces: routine permission prompts. Deny rules and explicit ask rules still run before the classifier and still win.
  • The headline number: in a study of 1,053 planted dangerous commands, human reviewers blocked 13.6% and auto mode blocked 89%.
  • The number further down the page: across 52 real cases where Claude acted beyond what the user authorized, the deployed classifier missed 17%.
  • Opting out: Shift+Tab in the CLI or the mode dropdown in the desktop app. A default you set yourself stays put.
Where the auto mode classifier sits in the Claude Code permission chain A tool call passes deny rules first, then explicit ask rules, then the auto mode classifier, and only then runs. Deny and ask rules are evaluated before the classifier, so an explicit rule always wins. DECISION PATH What happens to one tool call in auto mode permissions.deny never runs permissions.ask always prompts you auto mode classifier scores each action tool runs no prompt blocked outright you decide blocked, or allowed Your explicit rules are checked first, so an ask or deny rule always beats the classifier. By default it trusts only your working directory and the current repo's configured remotes. genztech.blog
Fig 1 Auto mode adds a second gate. It does not remove the first one: rules you write yourself are still evaluated before the classifier ever sees the call.

What actually changes on August 14?

Less than the framing suggests, and more than a settings tweak. Auto mode itself is not new; it shipped as an opt-in test in March 2026. What changes next Friday is which mode a new session starts in for consumer and Team accounts. Anthropic also stopped charging for the classifier's token overhead, effective immediately, which removes the quiet reason a cost-conscious user had to leave it off.

The classifier's default trust boundary is narrower than most people assume. Out of the box it trusts your working directory and the current repository's configured remotes, and nothing else. Pushing to your company's source-control org or writing to a shared cloud bucket gets blocked until you name those destinations in an autoMode.environment block. Expect the first week to produce false positives on perfectly routine internal operations, because the classifier has no idea what your infrastructure is until you tell it.

One detail worth knowing before you trust a repo you did not write: the classifier deliberately ignores autoMode settings in project-level files like .claude/settings.json. Those live inside the repo, so a checked-in file or a build step could otherwise inject its own allow rules. Trusted configuration has to come from your user settings or managed settings.

Why did Anthropic decide the human gate was the weak link?

Because it has the telemetry, and the telemetry is unflattering. Users approve 97% of Claude Code permission prompts. A gate that opens 97 times out of 100 is not filtering anything, it is charging a tax in attention and collecting nothing in safety. Worse, by June 2026 roughly 25% of interactive sessions were already starting in bypass permissions mode, which strips the prompts out entirely and puts nothing in their place.

That is the comparison Anthropic is actually making. Not classifier versus careful human review, but classifier versus a rubber stamp, and increasingly versus no gate at all.

Dangerous commands blocked by human reviewers versus the auto mode classifier In a study of 1,053 planted dangerous commands, human reviewers blocked 13.6 percent and the auto mode classifier blocked 89 percent. CATCH RATE Planted dangerous commands blocked, 1,053-command study Human reviewers 13.6% Auto mode classifier 89% 0 50% 100% IN REAL SESSIONS 6.3% of manually approved sessions contained harmful actions the user never asked for, against 2.4% of auto mode sessions. But on 52 real overreach cases, the shipped classifier still missed 17%. genztech.blog
Fig 2 · benchmark The catch-rate gap is large, and the study that produced it was artificial: testers knew they were being evaluated. The real-session numbers underneath are the more honest comparison.

What does the classifier still miss?

This is the part that deserves more attention than the 89%. Anthropic's own engineering results show the deployed classifier missed 17% of 52 real cases in which Claude acted beyond what the user had authorized. Fifty-two is a small sample, and 17% of it is roughly nine incidents, but it is drawn from actual usage rather than a lab with planted commands, which makes it the more load-bearing number of the two.

The 1,053-command study has a structural problem the headline rate hides: the testers knew they were in an evaluation. People behave differently when they know they are being scored, and the direction of that bias here is unclear. It could inflate human vigilance or, if testers assumed the harness would catch things, depress it.

The prompt-injection result is stronger but comes with a disclosure. Trajectory Labs found none of 720 attack attempts succeeded against Claude models running in auto mode. Both that evaluation and a related one from Apollo Research were commissioned by Anthropic. Commissioned does not mean wrong, and independent red-teaming is better than none, but it is not the same as an adversary with no relationship to the vendor.

 Manual approvalAuto modeBypass permissions
Prompts you per actionYes, constantlyOnly for flagged callsNever
What stops a bad callYou, at 13.6%Classifier, at 89%Nothing
Your deny and ask rulesEnforcedEnforced, before the classifierEnforced
Default from Aug 14NoYes, on Pro, Max, TeamNo
Reasonable forProduction repos you do not ownEveryday work in your own reposThrowaway sandboxes only

How do you keep a human checkpoint anyway?

You write it down, and you write it in the right file. The durable mechanism is permissions.ask, which is evaluated before the classifier and cannot be auto-approved by it. If you want to eyeball every push and every pull request while leaving auto mode on for everything else, three lines of settings do it:

  • permissions.ask forces a prompt for matching actions, for example Bash(git push *) and Bash(gh pr create *).
  • permissions.deny blocks before the classifier is consulted at all, and nothing overrides it. Use it in managed settings for boundaries that must never be crossed.
  • autoMode.classifyAllShell sends every shell command through the classifier, including ones a narrow allow rule like Bash(npm test) would otherwise wave through with an argument nobody anticipated.

Saying "do not push until I review" in conversation also works, with a real caveat Anthropic documents plainly: that boundary can vanish if context compaction drops the message that set it. Prose is not a guarantee. A rule in a settings file is.

Three CLI subcommands are worth learning on day one. claude auto-mode defaults prints the built-in rules, claude auto-mode config prints what your settings actually resolve to, and claude auto-mode critique reviews custom rules you have written. There is also a trap in the configuration format: setting allow, soft_deny, hard_deny or environment without including the literal string "$defaults" replaces the entire built-in list for that section, silently discarding rules like the force-push block and the data-exfiltration block.

RelatedClaude Sonnet 5: Near-Opus Coding at Half the Price

  1. Mar 2026Auto mode ships as an opt-in test Classifier runs only if you turn it on
  2. Jun 2026A quarter of interactive sessions start in bypass mode Prompts removed, nothing added in their place
  3. Aug 10, 2026Anthropic announces the default switch Classifier token overhead becomes free immediately
  4. Aug 14, 2026New sessions default to auto mode Pro, Max and Team plans
  5. Coming monthEnterprise and API accounts follow After admins have time to review

Who should think twice before taking the default?

Anyone whose Claude Code sessions touch infrastructure the classifier has never been told about. The default trust boundary covers your working repo and its remotes, which means teams with internal registries, shared buckets, or deploy pipelines will hit friction until autoMode.environment is filled in. Regulated environments have a second problem: the classifier reads prose rules and makes judgment calls, and "the model decided it was fine" is a harder story to tell an auditor than "a person approved it".

There is also a genuine asymmetry in the failure modes. A rubber-stamping human fails openly, and you can see the prompt you ignored. A classifier that misses fails quietly, in a session you were not watching, which is the entire point of turning prompts off.

For the wider agent market, the signal is more interesting than the setting. Anthropic is betting that autonomy-by-default is now a competitive requirement rather than a risk to be managed, and it published a miss rate to make that case. Rivals shipping coding agents will either match the default or explain why their prompt-heavy flow is worth the friction. Watch whether any of them publishes comparable numbers; so far almost nobody does.

What to watch · next 60 days
  • False-positive noise in week one. The narrow default trust boundary means blocked pushes to company orgs and internal registries. Volume of complaints will tell you whether the boundary was set too tight.
  • Whether the 17% figure moves. It is the only published number measuring the classifier against real overreach. If Anthropic updates it as the sample grows, the safety case gets much stronger. If it disappears, that is its own signal.
  • Enterprise rollout terms. Admins get a review window now. What controls they demand before the default lands will shape how the feature works for everyone.
  • Whether bypass mode usage falls. If the 25% figure drops, auto mode is genuinely absorbing the users who had opted out of safety entirely. That would be the strongest argument for the change.

Our take

The change is defensible and the reasoning is honest, which is rarer than it should be. Anthropic could have shipped the 89% and stopped. Publishing a 17% real-world miss rate alongside it is the part that earns trust, because it concedes the classifier is a better gate rather than a sufficient one.

What we would push back on is the implied framing that this is a safety upgrade for everyone. It is a clear upgrade over rubber-stamped prompts and an obvious one over bypass mode. It is a downgrade for the small number of people who actually read their permission prompts, and those people are disproportionately the ones working on things where a mistake is expensive. They should go set permissions.ask rules this week, before Friday, rather than discovering the new default mid-task.

The one thing nobody should do is treat auto mode as a reason to stop watching. A gate that catches 89% of what it sees, on a boundary it only understands as well as you have described it, is a good gate. It is not a supervisor.

Primary sources

Original analysis by GenZTech, based on Anthropic's announcement and Claude Code documentation published August 10, 2026.