Anthropic is making a bold bet that its AI can judge risk better than a fatigued human. Starting August 14, the company will activate auto mode by default across all Claude Code Pro, Max, and Team plans, fundamentally changing how developers interact with the coding assistant by removing the requirement for step-by-step human approval on most actions.
Under the new default setting, Claude Code will execute commands autonomously unless it classifies an action as “irreversible, destructive, or aimed outside your environment,” according to Anthropic’s announcement on Friday. The move marks a significant escalation in the AI coding assistant wars, where competitors are increasingly racing to offer greater autonomy while maintaining safety.
The decision is backed by striking internal data. In a study involving 1,053 paid testers, Anthropic found that auto mode caught 89% of dangerous commands, while humans in a manual review scenario spotted only 13.6%. The company attributes this massive gap to what it calls “manual review fatigue” — a phenomenon where users become desensitized to security prompts. Anthropic revealed that users approve 97% of all permission prompts in Claude Code, suggesting that the traditional approval process has become a reflexive click-through rather than a meaningful security checkpoint.
“Manual review can become habitual,” the company stated. “Claude Code asks users to make dozens to hundreds of critical security decisions per day, and the burden of constant confirmation makes it more likely that truly dangerous commands will be overlooked.”
The testing methodology was designed to be deceptive. During the study, testers were given investigative tasks to perform with Claude Code, but one of the approval prompts was secretly swapped with a dangerous command. Only 13.6% of testers caught the threat, while auto mode’s separate classifier — a dedicated system that reviews shell commands and actions independently — blocked 89% of harmful actions.
Third-party validation from Trajectory Labs further bolstered Anthropic’s case. The independent firm tested 72 types of prompt injection attacks against multiple AI models. Claude Code’s auto mode, running on Claude Sonnet 5, Claude Fable 5, and Claude Opus 5, successfully blocked all attacks — a 0% success rate for adversaries. In contrast, OpenAI’s GPT-5.6 Sol running on Codex with automatic approval enabled allowed 5.83% of attacks to succeed.
Boris Cherny, Head of Claude Code, expressed full confidence in the feature. “The team and I use Auto mode exclusively, and have been for many months,” Cherny wrote on X. “I couldn’t imagine going back to permission prompts!”
To address potential risks, Anthropic has layered in additional safeguards. The auto mode system now includes prompt injection screening and customizable “hard deny” rules that allow users and enterprise administrators to permanently block specific categories of actions, such as data exfiltration attempts. These controls are designed to give organizations granular oversight even as the AI operates more autonomously.
The rollout schedule is staggered. Pro, Max, and Team plan users will see auto mode become the default on August 14. Enterprise plan customers and those accessing Claude Code via API will receive the update in September or later. Users who prefer the old manual approval system can still disable auto mode and revert to step-by-step prompts.
Pricing for the Team plan, which is designed for workplace use and allows organizations to delegate coding tasks from concept to completion in the terminal, starts at $25 per member per month in the US with a two-seat minimum, billed monthly.
Anthropic first introduced auto mode as an experimental feature in March, positioning it as a way to balance speed and control. The rapid transition from opt-in test to default setting reflects the company’s growing confidence in its safety systems and a broader industry shift toward more autonomous AI tools. The change means developers can expect significantly faster completion of multi-step coding tasks, with fewer interruptions to approve routine commands.
For enterprises, the customizable hard deny rules offer a path to maintaining control over sensitive operations while still benefiting from the speed gains of automation. This combination of autonomy and guardrails could make Claude Code more attractive for large-scale deployments where security and efficiency must coexist.