The click was never the control

01What the week actually changed

On Monday the desk reported a vendor study and a date. On Friday the date arrived: new Claude Code sessions on Pro, Max and Team start in auto mode.¹² A second model — the classifier — reviews each tool call before it runs. Three blocks in a row, or twenty in a session, fall back to manual approvals. Classifier overhead on those plans is free.¹

Enterprise, the Claude API, Bedrock, Vertex and Foundry stay opt-in for now, with a plan to flip them in the coming month.¹ That is the product change. The argument is in the measurement that justified it, and in what the new default still permits.

02The study: 13.6 percent against 89

Anthropic ran a controlled study with 1,053 paid testers. Partway through a real session, one permission prompt was swapped for a clearly dangerous command. Humans refused 13.6 percent of the time — 143 of 1,053. Auto mode blocked 89 percent of the same commands — 937 of 1,053.¹

Head to head: auto mode blocked 800 commands a human approved; humans blocked six that auto mode allowed.¹ As sessions lengthened, humans got worse. They blocked about 17 percent of dangerous commands early in a session and about 5 percent after fifty or more prior prompts. The classifier's block rate stayed flat.¹

A second production cut, also from the vendor post: among flagged sessions, at severity 7 and above, 6.3 percent of manually approved sessions contained a harmful action the user had not asked for, against 2.4 percent under auto mode.¹ That is still vendor-commissioned evidence. It is also the only controlled comparison we have of human click-through against a classifier on this product.

Humans blocked the planted dangerous command 13.6 percent of the time. After fifty prompts, about 5 percent.

03What the residual 11 percent is not

Eleven percent of the planted commands still got through the classifier.¹ Simon Willison walked the same post and kept the residual risk open: he buys that auto mode beats clicking OK all day, and does not buy that prompt injection is solved.³

The third-party eval Anthropic commissioned from Trajectory Labs tested 72 indirect prompt-injection scenarios held out from the lab. Against Claude Fable 5, Opus 5 and Sonnet 5 in auto mode, none of 720 attack attempts succeeded in that eval.¹³ Willison wants confirmation beyond a vendor-commissioned study, and names a path a permission classifier cannot see: a malicious package whose install step looks like a normal test command.³

Those are different failure modes. Confirmation fatigue is a measured human failure on a clearly dangerous prompt. Prompt injection via a package install is a class of action the classifier may never be shown as hostile. Collapsing them into one safety claim is how the residual 11 percent gets misread as the whole remaining problem.

04Auto mode is not YOLO

Hacker News spent Monday mixing auto mode with --dangerously-skip-permissions.⁴ They are different products. Auto mode still classifies. Bypass skips the gate. The docs put bypass in isolated containers and VMs only.²

The same week, Cline removed its Yolo Mode toggle because it was cosmetic: auto-approve is now the single control, and prior Yolo setups migrate to approve-all.⁵ The industry is converging on one honest switch for "run without asking," and a separate layer for what still gets blocked. Calling every non-manual mode YOLO makes the safety claim sound like marketing even when a classifier is present.

05What the default still allows

The configuration page is explicit. Auto mode allows pushes to any branch of the repository you are working in, including the default branch, and pull request creation, by default.⁶ Force push, secrets entering a commit, history rewrites, and pushes aimed at a third-party repository stay blocked or soft-blocked.²⁶

A non-default branch whose name marks it as a deploy target — production, release, gh-pages — is judged on its own terms, including as a production deploy.⁶ Before v2.1.211 the allowlist was narrower: working branch, branches Claude created, and routine pushes to the default branch.⁶ The default widened as the mode became the starting mode.

The docs also ship the fix as a recipe, not as the default. To keep auto mode on and still get a human checkpoint before every push or pull request:⁶

That recipe is content-scoped permissions.ask. It is evaluated before the classifier and always forces a prompt.⁶ A one-line instruction in the conversation ("don't push until I review") can be lost when context compaction removes the message that stated it.⁶ The durable control is a rule in settings, not a sentence in chat.

Push to main and open a PR run without a prompt unless you add the ask rules yourself.

{
  "permissions": {
    "ask": [
      "Bash(git push *)",
      "Bash(gh pr create *)"
    ]
  }
}

06Why the human gate failed the product

The study is not a claim that classifiers are safe. It is a claim that the previous default was not doing the job the product assigned it. A gate that blocks a clearly dangerous command 13.6 percent of the time, and 5 percent after a long session, is a latency tax with a safety label.¹

That is why the default flip is the right product move for the median new user, and why it is still incomplete. Replacing a failing human gate with a classifier that is better on the same planted commands does not decide what counts as routine work. The vendor decided that a push to the default branch of the working repo is routine.⁶ Branch protection on the remote still applies. So does whatever CI runs on the landing. The local permission layer no longer stops the push by default.

Anthropic's own post still says the quiet part: for high-stakes changes to production infrastructure, review the actions yourself.¹ The classifier is a better average gate than a tired click. It is not a substitute for the boundary you actually care about.

07The parallel from the same week

Two other ships this week make the same shape visible outside Claude Code. pydantic-ai needed two security patches on its local web chat: first a CSRF-shaped hole where the chat endpoint ignored content type, then a Host-header gap that allowed DNS rebinding to reach the local agent and its tools.⁷⁸ The agent loop was fine; the surface that exposed it was not.

Grok Bot shipped as an always-on seat with its own cloud PC, gated to SuperGrok Heavy and Cursor Ultra.⁹ The seat assumes long unattended work. The safety question moves from "will the user click no" to "what can this computer reach when nobody is watching." That is the same migration auto mode forces on the CLI: from session-time human review to pre-declared boundaries.