Claude Code Turns Auto Mode On by Default
The uncomfortable finding underneath it: people approve 97% of the prompts they are shown.
Founder, Automation Squad ·
The short answer
Claude Code's auto mode becomes the default on August 14, 2026 for Pro, Max and Team plans. It proceeds without asking unless an action is irreversible, destructive, or aimed outside your environment. Anthropic's testing found it caught 89% of harmful actions, against 13.6% caught by humans clicking through approval prompts.
The ten-minute review to do before auto mode decides for you
Auto mode changes what happens when you are not looking. This is the pass to make once, today, so that default is one you chose.
Work out which plan you are on
The default change applies to Pro, Max and Team. If you are on one of those, the behaviour of every session you start from today is different to the behaviour you are used to.
Open your Claude Code settings and look at the permission behaviour
Find where approvals and permissions are configured before you need them mid-task. Knowing where the control lives is the point of this step — hunting for it while an agent is running is the wrong time.
Write your hard deny rules, and write them narrow
Anthropic ships customizable hard deny rules alongside this change. The useful ones are specific: production credentials, deploy commands, anything that sends email, anything touching a customer database. A deny rule you can state in one line is one you will keep.
Decide what 'outside your environment' means for you
Auto mode still stops for actions aimed outside your environment. Your working definition of that boundary and the tool's may differ — a repo you have write access to but do not own is the classic gap.
Notice your own approval rate
Anthropic's number is that users approve 97% of permission prompts. Before deciding you are the exception, recall the last three prompts you saw. If you cannot remember refusing one, you are in the 97%, and the prompt was never protecting you.
Run one real task and read the transcript afterwards
Not a toy task. Pick something ordinary, let it run, then read what it actually did end to end. That is the only way to calibrate how much autonomy feels right in your codebase.
| Anthropic's testing | Result |
|---|---|
| Paid testers in the study | 1,053 |
| Harmful actions caught by auto mode | 89% |
| Harmful actions caught by human review | 13.6% |
| Permission prompts users approve | 97% |
| Default applies to | Pro, Max, Team |
| Default active from | August 14, 2026 |
Take it with you
CLAUDE CODE AUTO MODE — review before it decides for you
Default from Aug 14, 2026 on Pro, Max and Team
Source: https://automationsquad.com/news/claude-code-auto-mode-default/
WHAT CHANGED
Auto mode proceeds WITHOUT asking, unless the action is judged
irreversible, destructive, or aimed outside your environment.
ANTHROPIC'S OWN NUMBERS (1,053 paid testers)
Harmful actions caught by auto mode ....... 89%
Harmful actions caught by human review .... 13.6%
Permission prompts users approve .......... 97%
The 97% is the argument. A prompt you always approve is not a control.
THE REVIEW
[ ] Confirm my plan — Pro / Max / Team means this is already on
[ ] Locate the permission settings BEFORE I need them mid-task
[ ] Write hard deny rules, narrow and specific:
[ ] production credentials
[ ] deploy / release commands
[ ] anything that sends email or messages
[ ] anything touching a customer database
[ ] ___________________________________
[ ] Define what "outside my environment" means for me
(watch for: repos I can write to but do not own)
[ ] Run ONE ordinary real task, then read the whole transcript
[ ] Decide, deliberately, how much autonomy I actually wantAnthropic is making auto mode the default in Claude Code from August 14, 2026, for Pro, Max and Team plans. In auto mode Claude Code carries on without asking, stopping only for actions it judges irreversible, destructive, or aimed outside your environment.
The facts: Anthropic ran a study with 1,053 paid users comparing auto mode against per-step human approval. Auto mode identified 89% of harmful actions; human review caught 13.6%. Anthropic attributes the gap to approval fatigue, citing its own finding that users approve 97% of permission prompts in Claude Code. The change ships alongside prompt-injection screening and customizable hard deny rules, which let you name categories of action that are refused regardless of context.
Automation Squad's take: the instinct is to read "AI asks permission less often" as a safety regression, and the data says the opposite — but only because the thing it is beating is so weak. A permission prompt you approve 97% of the time is not a control, it is a speed bump with a checkbox. That is the genuinely useful finding here, and it generalises well beyond Claude Code: every approval step in every workflow you own should be audited against the same question. If you cannot remember the last time you said no, that step is theatre and something else needs to be doing the work. The honest caveat is that 89% is not 100%, and the study is Anthropic's, about Anthropic's product.
Run this now: open Claude Code and write your hard deny rules before you start anything else — production credentials, deploy commands, anything that sends a message to another human, anything touching customer data. Keep each one narrow enough to state in a single line. Then run one genuinely ordinary task, let it go without interruption, and read the entire transcript afterwards. Not the summary. The transcript. That is the only way to find out whether your sense of what it should have paused for matches what it actually paused for.
Questions people are asking
- What is Claude Code's auto mode?
- A mode in which Claude Code proceeds with actions without stopping to ask, unless the action is determined to be irreversible, destructive, or aimed outside your environment. From August 14, 2026 it is the default rather than something you opt into.
- Which plans does the auto mode default apply to?
- Pro, Max and Team. If you are on one of those, sessions started from August 14 behave differently to what you are used to, without you changing anything.
- Is auto mode actually safer than approving each step?
- On Anthropic's own testing with 1,053 paid users, yes — auto mode caught 89% of harmful actions while human review caught 13.6%. The explanation Anthropic gives is approval fatigue: users approve 97% of permission prompts, so a prompt most people always click through is not functioning as a control.
- What protections are there if Claude Code stops asking?
- Anthropic pairs the change with prompt-injection screening and customizable hard deny rules, so you can name categories of action that are refused outright regardless of context. Writing those rules is the part that is on you.
Sources
Further reading
- Claude Code changelog — Where Claude Code's real behaviour changes get documented — several never reach the newsroom.
Last checked August 14, 2026 against the primary sources above, by Automation Squad Research. Spot an error? [email protected].