Claude Code Auto Mode Becomes the Default for Pro, Max, and Team Plans on August 14
Anthropic tested auto mode against 1,053 paid testers and found humans blocked 13.6% of dangerous commands. Auto mode blocked 89%. The classifier overhead is now free.
August 14 is the date. Starting that day, Claude Code auto mode runs by default for every Pro, Max, and Team plan session, replacing the old flow where Claude pauses and asks for approval on each tool call - and Anthropic is no longer charging for the classifier tokens auto mode consumes per tool call, effective today.
A Classifier Routes Each Tool Call - Not a Human Clicking Through Prompts
Claude Code auto mode runs a classifier on every tool call before execution. Irreversible or destructive commands get blocked; Claude usually finds a safer alternative on its own, or checks in with the user when it cannot proceed. Three consecutive blocks, or 20 total across a session, trigger a fallback to manual approvals. Some actions have no path through at all - data exfiltration sits in a hard-deny category that no classifier decision can override, regardless of what the user requests.
Humans Approved 97% of Prompts - and Caught Only 13.6% of Dangerous Commands
Numbers from Anthropic's study tell the case. Users approve 97% of all permission prompts in Claude Code - a rate suggesting most clicks are reflexive habit, not deliberate review. In a controlled study with 1,053 paid professional testers, humans caught just 13.6% of deliberately dangerous commands, while auto mode blocked 89% of the same set. Head to head, auto mode blocked 800 commands those testers approved, and testers blocked only six that auto mode allowed. As sessions ran longer, human performance dropped further: testers blocked about 17% of dangerous commands early on, falling to 5% after 50 or more prior prompts, while auto mode's block rate held flat.
Zero Prompt Injection Successes Against Claude Models - GPT-5.6 Sol Hit 5.83%
Prompt injection is the other test. When Claude pulls content from external sources, a probe scans for embedded instructions trying to redirect the agent; the classifier then checks whether the resulting action still aligns with the user's original intent. In a third-party evaluation by Trajectory Labs - 72 scenarios, 10 runs each - zero attacks succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode. GPT-5.6 Sol in Codex's auto-review mode had a 5.83% attack success rate in the same evaluation, a gap that matters for teams comparing AI coding tools on security grounds.
Teams Already Running Auto Mode Ship 25% More PRs
Production data backs the safety case. Among Teams and Enterprise adopters, Claude Code auto mode users ship roughly 25% more pull requests than those on manual permissions. Engineers running autonomous overnight loops are the clearest beneficiaries - Nuro's staff engineer Kai Zhou described kicking off an agent at 10 PM and waking to three finished PRs. Adobe uses auto mode to run a build-and-verify loop across 90+ countries and 30+ languages on Adobe.com; Gusto reports that about 10% of sessions since mid-May include a classifier denial, which shows the feature is doing real work without blocking legitimate tasks.
Enterprise Plans Stay Opt-In for Now - Default Coming Next Month
Enterprise plans stay opt-in for now. API users and those on Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry remain on opt-in until Anthropic coordinates the rollout with cloud partners, expected within the month. Enterprise admins can push the default company-wide today via the defaultMode setting in managed settings - Garner Health already did this for all 550 employees. To switch modes manually, Shift+Tab works in the CLI and the desktop app has a mode dropdown. Claude Code's cross-session messaging also shipped August 7, letting sessions warn each other mid-task - making this arguably the most active single day of updates Claude Code has seen, and the permission model is now the same regardless of how many sessions a developer runs at once.