Anthropic will make Auto Mode the default setting in Claude Code for Pro, Max and Team subscribers from August 14. The company says the system can identify and block risky actions while allowing Claude to work with fewer interruptions, although it continues to advise human review for high-stakes production changes.
Anthropic is changing how developers interact with Claude Code, making its more autonomous Auto Mode the default for Pro, Max and Team users from August 14. The move is designed to reduce the number of permission prompts developers see while Claude works through coding tasks, effectively shifting more responsibility from approving individual actions to reviewing the work produced by the AI.
Auto Mode was first introduced as an experimental feature in March. Rather than stopping for approval before every operation, Claude can continue working unless its system determines that an action could be destructive, irreversible or extend beyond the user’s environment.
Anthropic says the decision follows testing involving 1,053 paid users, along with internal security testing. According to the company, Auto Mode identified 89% of harmful actions in its tests, compared with 13.6 per cent detected through conventional human approval. Anthropic attributes part of the difference to users becoming accustomed to approving permission requests: its data shows that people accepted 97 per cent of Claude Code’s prompts.
Boris Cherny, who leads Claude Code at Anthropic, said on X that he and his team have been using Auto Mode exclusively for months. “I couldn’t imagine going back to permission prompts!” he said.
More from TechAnthropic adds safeguards as Claude gets more autonomy
The change does not mean Claude Code will operate without restrictions. Anthropic says it has introduced additional safeguards, including screening intended to detect prompt-injection attempts and configurable hard-deny rules designed to block specific categories of actions, such as attempts to move data outside the user’s environment.
The company also points to testing by independent security firm Trajectory Labs. It examined 72 prompt-injection scenarios, running each attack 10 times. Anthropic says none of the 720 attempts succeeded against its current models in Auto Mode, including Fable 5, Opus 5 and Sonnet 5. In the same testing, OpenAI’s GPT-5.6 Sol in Codex Auto-Review mode allowed 5.83 per cent of the attacks through.
Anthropic says Auto Mode has also prevented potentially damaging behaviour in its own environment. In one instance, the system stopped Claude from uploading confidential information to a public webpage. During another extended session, Claude terminated about 2,000 processes that could have interfered with GPU training workloads.
The company says the classifier used to assess actions does not add a separate token charge for users. However, greater autonomy could still have commercial implications. If developers allow Claude to work for longer periods without interruption, their sessions may consume more tokens, potentially increasing usage-based revenue.
More automation could change the developer’s role
Anthropic says teams using Auto Mode produced around 25% more pull requests during testing, suggesting that reducing interruptions can increase the amount of code developers get through the system.
But the productivity gains come with a trade-off. As coding agents take on more of the implementation work, developers may spend less time writing code themselves and more time examining, testing and correcting AI-generated changes.
Anthropic is not presenting Auto Mode as a substitute for human judgement in every situation. The company continues to recommend that developers personally review Claude’s actions when making high-stakes changes to production infrastructure.
That caveat points to a wider challenge with increasingly autonomous coding systems. Fewer approval prompts may make development faster, but developers still need enough understanding of the underlying codebase to recognise when an AI-generated change is wrong or potentially dangerous.
For now, Anthropic is betting that automated safeguards can handle routine decisions better than constant human approvals. The August 14 rollout will put that approach in front of a much larger number of Claude Code users, while leaving developers responsible for deciding where AI autonomy should stop.