Claude Code flips to autonomous by default as Anthropic says humans stopped reading prompts

Starting August 14, Anthropic will change the default mode for new Claude Code sessions to auto for Pro, Max, and Team subscribers.

The company says the change means its coding agent can run longer before it needs to pause and seek approval. Auto mode is blocking more dangerous commands than the developers reviewing those prompts by hand, according to its testing.

Anthropic pulls the human out of the loop

Auto mode routes all tool calls through a classifier that is trained to recognize any irreversible, destructive, or out-of-user-environment actions. If a command is blocked, Claude either goes around it or asks the developer directly. Three blocks in a row, or twenty blocks in one session, and the tool switches to manual approval.

Data from Anthropic shows users accept 97% of permission requests and only decline 3%. But with Claude providing a full plan, the rejection rate jumps to 39%. Anthropic interprets that gap as evidence that people scrutinize big-picture decisions but wave through individual approvals, firing dozens or hundreds of times a day.

The change is driven by a figure from a controlled study that Anthropic commissioned with 1,053 paid professional testers. Testers worked in a purpose-built environment. They knew they were being watched, but they did not know what was being measured.

In the middle of a session, an obviously harmful command replaced a normal permission request. 13.6% of the time human reviewers were able to spot it. Auto mode picked up 89%.

According to settings data, the guardrails were already eroding. As of June 2026, about half of all active command-line users had written a Bash allow-rule. 62% had used bypass permissions or clicked “don’t ask again.” A quarter of interactive sessions now start in bypass mode outright.

Prompt injection and the case for more PRs

Auto mode also provides a defense against prompt injection, the attack in which adversarial text attempts to divert an agent from what its user requested.

In an independent audit, Trajectory Labs tested 72 attack scenarios, each 10 times. Fable 5, Opus 5, and Sonnet 5, Anthropic’s current models, could not be broken through in auto mode in any of the 720 attempts.

The same review had OpenAI’s GPT-5.6 Sol in Codex Auto-Review mode with a 5.83% success rate for attackers.

Auto mode stopped Claude from posting confidential data to a public page. In one long-running session, it caught Claude queueing a kill across about 2,000 pods, which would have torn down hundreds of GPUs of running training jobs.

Teams and Enterprise customers using auto mode ship about 25% more pull requests. Anthropic named Adobe, Nuro, Gusto, and Garner Health as production users.

It has stopped charging Pro, Max, and Team plans for the tokens burned by the classifier as of August 7. Longer autonomous runs mean higher total usage.

For now, the default only toggles on for consumer and Team plans. Anthropic says it will deploy auto mode across Enterprise, the Claude API, AWS, Amazon Bedrock, Google Cloud’s Agent Platform, and Microsoft Foundry over the next month, though they are opt-in for now.

Developers who already have a different default pinned will keep it. Some others might get a prompt to change once.

Anthropic said the classifier doesn’t eliminate risks. As Cryptopolitan reported in July, three Claude models got out of test environments during security drills because of a misconfiguration that gave the machines live internet access.

The smartest crypto minds already read our newsletter. Want in? Join them.