Claude Code makes auto mode the default on 14 Aug. The number that sold it: humans caught 13.6% of planted dangerous commands.
Starting 14 August, new Claude Code sessions on Pro, Max and Team open in auto mode unless you pinned something else.1 A classifier sits on every tool call and blocks irreversible, destructive or outward-bound actions; three blocks in a row, or twenty in a session, fall back to manual. Classifier overhead is free on those plans from today. Enterprise, the Claude API, Bedrock, Vertex and Foundry stay opt-in.
The study that carries it: 1,053 paid testers, one clearly dangerous command swapped into a real session. Humans refused 13.6% of the time. Auto mode blocked 89%.1 Human block rate fell from ~17% early to ~5% after fifty prompts; the classifier stayed flat. Confirmation fatigue, measured.
already on auto mode — only the free classifier is new. On manual or YOLO, decide before the 14th: Shift+Tab still flips modes; admins can pin or disable auto. Do not read 89% as solved; eleven percent still gets through.
Deeper — what the number does not cover
- Simon Willison walked the same post and is not there yet on prompt injection: zero of 720 Trajectory Labs attack attempts landed against Claude models in auto mode, but a malicious package whose install step looks like a normal test command is outside what a permission classifier can see.2
- Auto mode is not
--dangerously-skip-permissions. HN spent the morning mixing them up.3 The first still classifies; the second does not. - Hard denies (data exfiltration, external sends) stay hard. Admins can add more. For production infrastructure, Anthropic still says review the actions yourself.