Anthropic sets Claude Code to Auto Mode by default to protect developers from bad approvals
Claude Code will soon run in Auto Mode by default. Only Enterprise customers still need to opt in. The change means AI handles even more of the development process on its own.
Auto Mode lets the AI coding tool work on its own without waiting for manual approval at every step. A classifier checks whether an action is dangerous or irreversible and only asks for confirmation in those cases.
Starting August 14, Claude Code will ship with Auto Mode enabled by default for Pro, Max, and Team plans, as Anthropic announced in a blog post. In tests with 1,053 paid testers and internal red-teaming, Auto Mode performed at least as safely as manual approvals, and often better. Teams using Auto Mode also generated about 25 percent more pull requests, meaning they got more work done.
Anthropic also says Auto Mode adds a layer of protection against prompt injection attacks, where injected code tries to hijack the agent away from the user's instructions. An independent audit by Trajectory Labs tested 72 attack scenarios ten times each. None of the 720 attempts succeeded against Claude's current models, Fable 5, Opus 5, and Sonnet 5, in Auto Mode. With OpenAI's GPT-5.6 Sol in Codex Auto-Review mode, 5.83 percent of the attacks got through.
Internally at Anthropic, Auto Mode stopped Claude from uploading confidential data to a public page. During one long session, it also killed roughly 2,000 processes that would have disrupted ongoing GPU training jobs, the company says.
Anthropic doesn't charge for the tokens the classifier itself consumes. But making Auto Mode the default is likely still a good deal for the company. When Claude works longer and gets more done, total token usage goes up, and so does revenue, even if that wasn't Anthropic's main motivation for the change.
Developers shift from writing code to watching AI write it
Claude Code is currently the most widely used AI coding tool by a wide margin, and making Auto Mode the default pushes the developer's role further from active coding toward reviewing AI-generated output. Anthropic itself urges caution.
The classifier reduces risks but doesn't eliminate them. "For high-stakes changes to production infrastructure, we still recommend reviewing Claude's actions yourself," the company writes.
That advice creates a paradox. The less often developers step in, the more their oversight matters. But it gets harder to build a deep understanding of projects that were largely built by Auto Mode without much human involvement. And cybersecurity is moving faster and growing more complex than any human can realistically keep up with.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.