Claude Code Stopped Asking Before Every Command. You Were Approving 97% of Those Prompts.

On 14 August, auto mode became the default for new Claude Code sessions on Pro, Max and Team plans, so the tool now runs commands without asking unless a classifier judges the action irreversible, destructive, or aimed outside your environment.

The number Anthropic used to justify it: across 1,053 paid testers, auto mode blocked 89% of harmful actions and human approval caught 13.6%, because people approve 97% of permission prompts without really reading them.

The number worth keeping is a different one in the same study. Those users rejected 3% of individual permission prompts and 39% of plans. Same people, same risk appetite, different unit of review.

What actually changed

Anthropic announced on 8 August that auto mode would become the default, and flipped it on 14 August. It applies to Pro, Max and Team. Enterprise, API, and the Bedrock and Vertex and Foundry deployments keep their existing defaults and have to opt in. If you already pinned a permission mode yourself, nothing changes. Everyone else got a one-time prompt.

Auto mode is not "approve everything." A classifier sits in front of each action and blocks the ones it reads as irreversible, destructive, exfiltrating data, or escalating privileges beyond what the task needs. It checks git status before destructive git operations. There is a hard-deny list that no amount of user instruction talks it past. The classifier used to cost you tokens, and now does not.

So the gate did not disappear. It moved from you to a model, and the argument for moving it is that you were never really standing at it.

The 13.6% is not an insult

It is tempting to read the headline comparison as a claim that models have better judgment than developers. That is not what the study measures.

The head-to-head is the clearest cut. Auto mode blocked 800 dangerous commands that humans approved. Humans blocked six that auto mode let through. That is not a contest of judgment, it is a contest of attention. The classifier reads every single command with the same care on call number 400 as on call number one. You do not, and no one does.

Anthropic calls this approval fatigue, which is the polite version. The mechanical version is that a permission prompt asks you to evaluate a shell command in isolation, several times a minute, while you are holding the actual problem in your head. The prompt interrupts the thing that makes you good at reviewing, then asks you to review. Sessions run under manual approval contained unintended harmful actions more than twice as often, 6.3% at production severity against 2.4% for auto mode.

Anyone who has clicked through a certificate warning knows how this ends. The interesting part is that the industry built the entire agent permission model on the assumption it would end differently.

Where humans are still expensive and worth it

The finding that did not travel with the headline is the split. The same testers who waved through 97% of individual permissions rejected 39% of plans.

A thirteenfold difference in rejection rate, from the same population, is not a story about vigilance. It is a story about what a person can actually evaluate. Shown rm -rf ./build, you have almost no basis for judgment. Is that the right directory? Is it in .gitignore? Did the agent already move something there? You cannot know without reconstructing the agent's entire state, and you have four seconds. So you approve, and you are usually right to, which is exactly why the habit forms.

Shown a plan that says "I will clear the build directory, regenerate the client from the OpenAPI spec, and update the three call sites," you can evaluate it instantly, because you know whether that is the job. Intent is checkable against something you already hold. Syntax is not.

This is the same split I keep landing on from a different direction. The two jobs left for a person on an agent team are setting the bar, which happens before, and holding the bar, which happens after. Per-command approval is neither. It is the middle, and the middle is the part that crossed over. Auto mode is Anthropic conceding that in the product, with data.

If you take one operational thing from this, take that. Move your review budget to the plan and to the diff. The plan is where you catch the wrong job. The diff is where you catch the wrong execution. The command prompt in between was collecting your reflexes, not your judgment.

The caveats, which are real

Anthropic ran this study on its own product, and the result happens to point at less friction, which also means longer sessions and more tokens. The incentive alignment is worth saying out loud. A third party, Trajectory Labs, was commissioned for evaluation, and that helps, but it is not the same as independent replication.

Then there is the 11%. Simon Willison, who has tracked prompt injection longer and more carefully than almost anyone, called auto mode a better solution than constant human approval and still flagged the gap. Anthropic reports zero successes across 720 indirect injection attempts in 72 scenarios, against 5.83% for a competitor's auto-review mode. Zero out of 720 is a good number. It is not a proof, and the scenarios were written by the defender.

Willison's specific worry is the shape to watch: a dependency whose README says to fetch model files with some command before running the test suite, where the fetch is the attack. That reads as ordinary setup, sits inside a legitimate task the user asked for, and does not look destructive to anything checking whether an action is irreversible. The classifier is trained on harm, and the sharpest attacks route around harm by looking like work.

Note also what auto mode is not. It is not a sandbox. Sandboxing and permission classification are separate layers, and the announcement is about the second one. If your agent has a live production credential in its environment, a smarter approval classifier is not the control you were missing.

What to do this week

If you are on Pro, Max or Team and you did not pin a mode, you are in auto mode now. Two things are worth ten minutes.

Check what is actually reachable from the agent's environment, because the blast radius assumption just changed. Auto mode reasons about whether an action leaves your environment, which means your definition of "your environment" is now load-bearing. Credentials in a shell profile, a kubeconfig pointing at prod, an SSH agent with forwarded keys, those were always the real exposure. The permission prompt was never protecting you from them, it was just making you feel present while they sat there.

Then look at where your plan review happens. If the honest answer is that a ticket goes in one end and a diff comes out the other, with the agent improvising everything in between, that gap is where the 39% rejection rate lives, unused.

The permission prompt is being retired because it turned out to measure compliance, not attention. Nothing about that says the review was unnecessary. It says it was happening at the wrong moment, on the wrong object, at a rate no human was ever going to sustain.