Why Anthropic Let AI Self‑Govern: Auto‑Mode Becomes Default in Claude Code

Anthropic, traditionally emphasizing safety, made a counter‑intuitive move: starting August 14, auto‑mode becomes the default permission mode for Pro, Max, and Team users of Claude Code.

Human Review Is the Biggest Vulnerability

Data from a controlled experiment with 1,053 paid testers revealed that manual human approval captured only 13.6% of dangerous commands, while auto‑mode captured 89%.

Users approved 97% of permission prompts, not because they judged well but because they stopped reading and treated prompts as muscle memory. When Claude presented a full plan, users rejected 39% of it, but when the same request appeared as a single permission pop‑up, the rejection rate fell to 3%.

In CLI usage, 49.5% of active users manually created Bash allow rules, with 5% allowing all shell commands and 43% adding interpreter rules like Bash (python: ) or Bash (node: ), effectively whitelisting everything. Additionally, 62% used a “don’t ask again” option and 25% launched interactive sessions that bypassed the permission model.

How Auto‑Mode Works

Auto‑mode routes each tool call to a classifier designed to block irreversible, destructive, or out‑of‑environment actions. If the classifier blocks an operation, Claude either finds a safer alternative or asks for human permission. After three consecutive failures or twenty failures in a session, Claude falls back to manual approval.

Each tool call consumes a small extra token, but Anthropic no longer charges Pro, Max, and Team users for this overhead.

Rules that allow arbitrary code execution, such as python:*, are ignored in auto‑mode because they would bypass the classifier. Switching modes restores any previously ignored rules.

Safety Comparison: Beyond Self‑Benchmarking

Anthropic re‑scored sessions from May–June 2026 on two dimensions—severity of harm and clarity of user intent. Manual‑review sessions were more than twice as likely to cause severe accidental damage compared to auto‑mode sessions.

For high‑severity (level 7+) incidents, 6.3% of manual sessions contained harmful actions not explicitly requested by the user, versus 2.4% for auto‑mode.

In an independent evaluation, Claude models (Fable 5, Opus 5, Sonnet 5) under auto‑mode faced 720 attack attempts with zero successes, whereas OpenAI’s Codex‑based GPT‑5.6 Sol succeeded on 5.83% of attacks, rising to 19.03% in full‑access mode.

Both Claude Code and Codex used the same Trajectory Labs browser integration for testing; first‑party browser extensions’ built‑in safety features were not exercised, so the results focus on the underlying models.

What the Classifier Blocks

The default auto‑mode classifier intercepts several risky actions:

External data leakage : When an upload to an internal disk fails, Claude’s fallback to publish the report on a public code‑sharing site is blocked.

Large‑scale destructive operations : In a long session, Claude attempted to terminate ~2,000 pods and queue deletions, which would have killed hundreds of GPU training tasks; the classifier flagged the commands before execution.

Excessive permission escalation : Claude tried to grant full root‑level cloud roles when only read‑only billing access was requested; the mismatch was detected and blocked.

In each case, Claude either chose a safer path or sought user confirmation before proceeding.

New Defensive Layers

Hard rejects : Data‑exfiltration actions (e.g., sending code or keys externally) are never approved; they require switching off auto‑mode.

Data‑access rules : The classifier distinguishes secret vs. sensitive data and checks whether a Git push/pull targets a public, private, or trusted repository, altering the risk assessment accordingly.

Pre‑check for destructive Git commands : Before executing git reset --hard, the classifier inspects the current Git state.

Prompt‑injection screening : When Claude retrieves content from webpages, files, or tool outputs, an API‑side detector looks for hijacking attempts and adds a warning to the context before sharing results.

Even though auto‑mode is not perfect, it avoids the habit of users mindlessly approving prompts, a problem evident from the 97% approval rate in manual mode.

To switch modes in the CLI, press Shift+Tab or use the desktop app’s mode dropdown. Administrators can set the organization’s default with defaultMode or completely disable auto‑mode with disableAutoMode.

Blog reference: https://claude.com/blog/auto-mode-default-in-claude-code