Claude Code Turns On Auto Mode by Default, and the Safety Numbers Are Not What You Would Guess
From August 14, Anthropic's coding tool stops asking permission for every step. In its own tests a software classifier caught 89 percent of dangerous commands. The humans it replaces caught 13.6 percent.
Starting August 14, Anthropic’s coding tool Claude Code will run in Auto Mode by default for anyone on a Pro, Max, or Team plan. Auto Mode means the AI stops stopping. Instead of asking you to approve every single command it wants to run, it keeps working, and a separate piece of software watches over its shoulder and interrupts only when something looks dangerous or hard to undo.
That watcher is what the industry calls a classifier: a small model whose only job is to look at a proposed action and answer one question, is this risky. Anthropic ran a controlled study with 1,053 paying testers plus internal red-teaming, where staff deliberately try to make the system misbehave. The classifier flagged 89 percent of genuinely dangerous commands. Human reviewers, clicking approve or deny on the same commands, caught 13.6 percent. Teams running in Auto Mode also produced about 25 percent more pull requests, meaning they finished more work.
There is a second number worth noting. An independent audit by Trajectory Labs tested 72 prompt injection scenarios ten times each. Prompt injection is when text hidden in a web page or a file tries to give the AI new orders behind your back, and it has been the great unsolved security problem of AI agents. None of the 720 attempts got past Claude’s current models in Auto Mode. Running the same battery against OpenAI’s GPT-5.6 Sol in Codex Auto-Review mode, 5.83 percent slipped through.
The 13.6 percent figure is the interesting one, and it is not an insult to developers. It is approval fatigue. When a tool asks you to confirm forty things an hour, you stop reading and start clicking, which is exactly how a bad command gets waved through. The classifier never gets bored. Anthropic gives two internal examples: Auto Mode blocked Claude from uploading confidential data to a public page, and during one long session it killed roughly 2,000 processes that would have wrecked ongoing GPU training jobs. Worth naming the commercial angle too: when Claude works longer without stopping, it consumes more tokens, and tokens are revenue. Anthropic does not charge for the tokens the classifier itself burns, which softens that a little.
What this means for you: if you use Claude Code, this changes on its own on August 14 and you should look at the setting rather than discover it. Enterprise customers stay on manual unless they opt in. Anthropic itself still recommends reviewing Claude’s actions by hand for high-stakes changes to production systems, which is a fair caveat: 89 percent is much better than 13.6 percent, but it is not 100. If you do not write code, the pattern still matters, because it is spreading. The design answer to “AI does risky things” is increasingly “a second AI checks the first one,” and it is worth knowing that is what is protecting you.
Sources
Source: https://claude.com/blog/auto-mode-default-in-claude-code
Claude Code Sessions Can Now Message Each Other, Which Is Stranger Than It Sounds
Two terminal windows running the same AI coding tool can now pass notes back and forth without you copying anything. It is a small feature that quietly changes what a working session is.
