IMPLICATOR
Anthropic will make auto mode the default for new Claude Code sessions on Pro, Max, and Team plans starting August 14, 2026. Instead of asking the user to approve each eligible action, Claude Code will route tool calls through a classifier that decides whether they can run. In a controlled study, humans blocked 13.6% of planted dangerous commands while auto mode blocked 89%.
What Changed
- Starting August 14, 2026, new Claude Code sessions on Pro, Max, and Team plans run in auto mode, routing tool calls through a classifier instead of asking the user to approve each action.
- In a controlled study, human testers blocked 143 of 1,053 planted dangerous commands. Auto mode blocked 937 of the same set.
- Anthropic's own engineering results show the deployed classifier missed 17% of 52 real cases in which Claude acted beyond what the user had authorized.
- Both outside evaluations, by Trajectory Labs and Apollo Research, ran at the invitation of the company whose product they assessed.
AI-generated summary, reviewed by an editor. More on our AI guidelines.
What changes on August 14
New sessions will enter auto mode unless a user or Team administrator has already set another default. On August 7, 2026, Anthropic also stopped charging Pro, Max, and Team users for the extra tokens consumed by the classifier.
Enterprise and API users remain opt-in for now. Anthropic plans to extend the default to those customers in the coming month, after administrators have time to review the change.
Auto mode uses two layers. A server-side screen checks material returned by tools for hidden prompt-injection instructions before Claude reads it. A transcript classifier running on Sonnet 4.6 judges proposed actions against the user's instructions and the working environment's trust boundaries before they run; it sees user messages and tool calls, but not Claude's reasoning or tool results. Shell commands, web fetches, external tools and out-of-project file operations go through the classifier. After three consecutive denials, or twenty during one session, Claude Code returns to manual approval; a headless run terminates.
Why prompts stopped working
Anthropic's data published August 7, 2026, says users approve 97% of Claude Code permission prompts. As of June 2026, 25% of interactive sessions started in bypass permissions mode, which removes the prompts entirely.
A controlled study placed one clearly dangerous command before 1,053 paid professional testers. Humans blocked 143 of the 1,053 commands; auto mode blocked 937. The testers worked in an environment created for the study, not in their own codebases, and knew they were being evaluated.
Get Implicator.ai in your inbox
Strategic AI news from San Francisco. No hype, no "AI will change everything" throat clearing. Just what moved, who won, and why it matters. Daily at 6am PST.
No spam. Unsubscribe anytime.
What the classifier misses
The safety case has a gap in Anthropic's own engineering results. The deployed pipeline missed 17% of 52 real cases in which Claude tried to act beyond what a user had authorized. Anthropic called that “the honest number.” It said careful manual reviewers could be worse off because they would trade their judgment for a classifier that sometimes makes a mistake.
In a Trajectory Labs evaluation of the latest publicly available versions of Claude Code and Codex as of July 17, 2026, none of 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 in auto mode. Anthropic commissioned the Trajectory Labs evaluation and worked with Apollo Research on a two-week pilot, so both outside efforts ran at the invitation of the company whose product they assessed.
Know someone who'd find this useful? ✉️ Email it to a friend in one click, or they can subscribe free here.
The package-install gap
Simon Willison, who coined the term “prompt injection,” described a malicious third-party package whose instructions tell the agent to fetch and run a second malicious package that exfiltrates available data. Auto mode's documented exceptions permit installation of packages already declared in a repository manifest, so the command can look authorized even when the downloaded code is hostile.
“I'm not sure how any version of auto mode could protect against that kind of malfeasance,” Willison wrote.
Anthropic's guidance retains a human backstop: “For high-stakes changes to production infrastructure, we still recommend reviewing Claude's actions yourself.”
Mykola Kondratiuk, a director at Playtika, identified a governance problem. “With Auto Mode on, the AI is now the approver, not just the actor. Most governance docs still name a human there and haven't been updated.”
Frequently Asked Questions
When does auto mode become the default in Claude Code?
August 14, 2026, for new sessions on Pro, Max, and Team plans. A default the user or a Team administrator has already set stays in place. Enterprise and API users remain opt-in for now, and Anthropic plans to extend the default to them in the coming month.
What does auto mode actually do?
It works in two layers. A server-side screen checks material returned by tools for hidden prompt-injection instructions before Claude reads it. A transcript classifier running on Sonnet 4.6 then judges each proposed action before it runs, seeing user messages and tool calls but not Claude's reasoning or tool results.
Does the classifier cost extra tokens?
On August 7, 2026, Anthropic stopped charging Pro, Max, and Team users for the extra tokens the classifier consumes.
How often does the classifier miss a dangerous action?
Anthropic's engineering results show the deployed pipeline missed 17% of 52 real cases in which Claude tried to act beyond what a user had authorized. Anthropic called that figure the honest number.
What happens if auto mode keeps blocking an action?
After three consecutive denials, or twenty across one session, Claude Code returns to manual approval. A headless run terminates instead.
AI-generated summary, reviewed by an editor. More on our AI guidelines.
Related stories
Marcus Schuler
Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai
