Anthropic will make auto mode in Claude Code the default for new sessions on Pro, Max, and Team plans starting August 14. Users who previously selected a different default may receive a one-time prompt asking whether they want to switch to auto mode.
In a controlled experiment with 1,053 paid professional testers, human review caught just 13.6% of dangerous commands, while auto mode caught 89%. (Source: Anthropic)
It remains optional on Claude Enterprise, the Claude API, Anthropic Platform, Amazon Bedrock, Google Cloud’s Agent Platform, and Microsoft Foundry, giving administrators time to evaluate the feature before enabling it. Anthropic plans to make auto mode the default across these platforms over the next month and will stop charging for the additional compute required to run its safety classifier.
Auto mode reduces risk for most users but does not eliminate it because it relies on AI to judge whether actions are safe. The company recommends that users still review Claude’s actions before making high-risk changes, such as modifying production systems or critical infrastructure.
In auto mode, the system routes every tool call through a classifier designed to block irreversible or destructive actions, along with actions targeting resources outside the user’s environment. When the classifier blocks an action, Claude either finds a safer alternative or asks for user approval. If it cannot make progress after three consecutive blocks or 20 blocks during a session, Claude switches back to manual approvals.
“We spent the last several months testing whether auto mode is as safe or safer than an average user clicking through prompts. We ran internal red-teaming, third-party red-teaming and prompt-injection evaluations, a controlled study with 1,053 paid testers, and analysis of real production sessions. On every measure we tested, auto mode matched or outperformed manual review,” Conner Phillippi, Member of Technical Staff at Anthropic, explained.
The mode allows Claude to work autonomously for longer periods, reducing user overhead while increasing output.
How auto mode compares with manual approval
Anthropic said developers approve 97% of permission prompts in Claude Code, suggesting many requests are approved without close review. The company also found that many users had already weakened or bypassed permission checks by changing their settings.
Internal and independent testing found auto mode was safer than manual approvals. In a study of 1,053 paid testers, participants blocked 13.6% of dangerous commands, while auto mode blocked 89%. Analysis of flagged real-world sessions also found manual approval was more than twice as likely as auto mode to result in harmful actions that users had not explicitly requested.
The company worked with AI safety company Apollo Research to evaluate auto mode against simulated cyberattacks. After improvements, the classifier’s attack miss rate fell from 12% to 7%. The attacks were intentionally designed to expose weaknesses and were more malicious than typical real-world use.
Protection against prompt injection
Auto mode adds another layer of protection against prompt injection attacks, in which malicious instructions hidden in websites, documents, or other content attempt to trick the agent into ignoring a user’s instructions.
An independent evaluation by Trajectory Labs found that none of the 720 prompt injection attacks succeeded against Claude models running auto mode. In the same benchmark, Trajectory Labs recorded a 5.83% success rate against OpenAI’s GPT-5.6 Sol running Codex’s Auto-review mode and a 19.03% success rate when Codex ran in full-access mode.
“Safeguards built into first-party browser integrations such as the Chrome extensions provided by OpenAI and Anthropic were not tested. As such, these results should be viewed as a measurement of the underlying model, rather than the complete set of safeguards which might exist in a given deployment,” Philippi continued.
How Anthropic uses auto mode internally
Anthropic uses auto mode across all Claude Code workflows. The classifier has prevented an off-network data leak, a destructive mass operation, and overly broad privilege escalation. In each case, Claude either found a safer alternative or asked the user for approval before taking further action.
The company also introduced features including hard denies, rules governing data access and sharing, git status checks before destructive Git actions, and prompt injection screening to make auto mode safer for production use.
“Auto mode gave us a safer balance between speed and control. We were able to remove the repeated prompts and increase productivity without compromising safety. We can see that auto mode blocks at the right time, which gives us the confidence to move quickly,” Martin Emde, Software Engineer at Gusto, said.
Download: The ultimate guide to network operations management