Why Anthropic Says Claude Code’s Auto Mode Is Safer After Testing 1,000 Users

Anthropic announced that, starting August 14, Auto Mode becomes the default permission mode for Claude Code Pro, Max, and Team users. The mode routes every tool call through a separate classifier that reviews shell commands and operations.

The classifier captured 89% of dangerous commands in tests, while human‑approved prompts only caught 14%, indicating that the agent tool’s infrastructure‑level defenses are now mature enough to be the default for maximum development efficiency.

Anthropic explained that the change is driven by test results showing Auto Mode’s safety matches or exceeds manual review. In a controlled experiment involving 1,053 paid professional testers, auto mode performed at least as well as manual approval across all metrics.

Manual review data reveal that users approve 97% of permission prompts, often habitually clicking without scrutiny, while rejecting 39% of presented plans but only 3% of single permission requests. Configuration‑file rules still apply before the classifier, except for permissive rules like python:* which are ignored in Auto Mode.

Auto Mode enables Claude to run longer tasks, allowing models such as Claude Opus 5 to handle large workloads more effectively. Anthropic reports a ~25% increase in PR submissions from Teams and Enterprise users, with companies like Adobe, Nuro, Gusto, and Garner Health adopting Auto Mode as the production default.

Safety comparisons show that manually reviewed sessions are over twice as likely to cause severe accidental damage. For severity levels 7 and above, 6.3% of manual sessions contained unrequested harmful actions versus 2.4% for Auto Mode. In independent attacks, Claude models suffered zero successful breaches, while Codex’s GPT‑5.6 Sol under auto‑review permissions had a 5.83% success rate, rising to 19.03% in full‑access mode.

The classifier also blocks three concrete risky operations: (1) external data leakage – refusing to publish failed uploads to public code sites; (2) large‑scale destructive actions – halting attempts to terminate ~2,000 pods that would kill hundreds of GPU training jobs; (3) excessive permission escalation – detecting mismatches when Claude tries to grant root‑level cloud roles for a read‑only billing request.

New Auto Mode features include hard‑reject rules for data‑leak actions, refined data‑access and sharing policies that check repository visibility before pushes, git‑status checks before destructive git commands, and prompt‑injection screening that adds warnings when external content appears to hijack Claude’s behavior.

Users can switch modes in the CLI with Shift+Tab or via the desktop app’s mode dropdown. Administrators may set the organization‑wide default with the defaultMode parameter or disable Auto Mode entirely using disableAutoMode.