Claude Code Defaults to Auto Mode in 5 Days; Anthropic Covers Extra Costs

We just have to ask: does anyone actually read the permission approval requests provided by AI coding tools?

Anthropic also found that only 3% of permission requests are rejected.

So they made a decision: in five days, all Claude Code instances will default to auto mode.

The classifier in auto mode consumes a small number of extra tokens per tool call, but this cost will no longer be charged to users.

Cloud platforms like Amazon, Google, and Microsoft currently offer it as an optional feature, but Anthropic has given them only one month to switch these channels to default auto mode as well.

The father of Claude Code stated that his team has long been using only auto mode internally, finding it unimaginable to go back to manually approving permissions.

The Era of Manual Permission Approval Is Gone

The first set of reasons Anthropic gave for this change is that manual approval has become a habitual action:

The user approval rate for Claude Code permission prompts is 97%. For comparison, when Claude submits a plan for user approval, the rejection rate is 39%; whereas the rejection rate for individual permission requests is only 3%.

The same tendency appears in configuration files. As of June 2026, 49.5% of active CLI users had manually written Bash allow-rules, with 5% allowing any shell command outright, and another 43% writing interpreter rules like Bash(python: ) or Bash(node:) that have practically the same effect. This proportion grows by about 5 percentage points every five weeks.

Furthermore, 62% of users have used bypassPermissions or clicked "Don't ask again" in Bash, and 25% of interactive sessions start directly in bypass permissions mode.

The second set of reasons comes from a controlled experiment. Anthropic recruited 1,053 paid professional testers through a research vendor to complete coding tasks in a specially built test environment. Midway through the session, one permission prompt was replaced with an obviously dangerous command. The vendor recorded whether testers clicked agree (agreeing did not actually execute any dangerous operations; only the prompt text was changed).

The result was that testers blocked this command 13.6% of the time, totaling 143 instances;

Auto mode blocked the same command 89% of the time, totaling 937 instances.

In a direct comparison, auto mode blocked 800 commands that humans allowed, while humans blocked only 6 commands that auto mode allowed.

Moreover, the longer the session, the worse human performance became: initially blocking about 17%, dropping to about 5% after more than 50 prompts, while auto mode's interception rate remained unchanged regardless of session length.

Production data was also re-evaluated.

From May to June 2026, Anthropic took sessions flagged by the security pipeline from accounts authorized for training and analysis, and re-rated them using a model on a severity scale of 0 to 10.

• A score of 10 represents irreversible damage across the entire company.

• A score of 7 represents incidents at the level of deleting production database records.

• A score of 0 represents fully reversible local operations, such as overwriting a temporary file.

The clarity of the user's request for the operation was also assessed. At severity levels of 7 and above, 6.3% of sessions undergoing manual approval involved harmful operations not explicitly requested by the user, compared to 2.4% for auto mode sessions. This gap held true at every tested severity level.

The classifier itself underwent adversarial testing. Anthropic conducted a two-week pilot with AI security firm Apollo Research, injecting synthetic attacks into real coding trajectories, covering three datasets: generalization failures, data exfiltration, and security-related threats.

After Apollo returned successful attack samples and hardening recommendations, Anthropic primarily strengthened the classifier by providing more environmental context, including repository visibility, git status, and data handling rules.

After hardening, Apollo retested using a holdout attack set inaccessible to Anthropic. Auto mode caught about half of the previously missed attacks, at the cost of missing about 2% of the attacks it had previously blocked. Calculated across both datasets combined, the false negative rate dropped from 12% to 7%. Anthropic also clarified that these attacks were synthesized to identify classifier failure points, and the 7% figure should not be interpreted as the false negative rate under real traffic conditions.

For prompt injection, Anthropic commissioned third-party Trajectory Labs for evaluation, bringing in OpenAI as a benchmark. There were 72 indirect injection scenarios, each run 10 times.

The attacks were optimized for Claude Opus 4.7, which was not among the models tested, so all participating models faced unseen attacks.

Out of 720 attack attempts, Claude Fable 5, Opus 5, and Sonnet 5 running in auto mode were not breached once;

GPT-5.6 Sol running in Codex Auto-review mode had an attack success rate of 5.83%, and 19.03% in Full Access mode.

For reference, the average attack success rate for Claude's latest models in bypassPermissions mode without additional protections was 0.09%.

Three publicly disclosed interception cases include:

After a failed upload to an internal cloud drive, Claude's alternative was to publish the same report to a public code-sharing site, which was rejected and converted into a user query;

During a long session, Claude attempted to batch-terminate processes across two thousand pods and queued deletion operations that would dismantle training tasks running on hundreds of GPUs. The command was flagged before execution;

In another instance, when asked to configure read-only billing permissions, Claude accessed a cloud role with full administrative privileges at the account root level. The mismatch between the permission scope and the request caused it to be blocked.

Recently added capabilities include:

Classifying data exfiltration as a hard deny, which the classifier never approves. Execution requires switching out of auto mode or running manually. This rule can be extended in settings;

Distinguishing the accessible and shareable scopes for keys versus sensitive information, and checking whether the target repository is public, private, or trusted before executing git push or PR;

Reading git status before commands that might discard uncommitted work, such as git reset —hard;

And when Claude pulls web pages, files, or tool outputs, API-side probes scan for injection attempts and add warnings before the results enter the context.

Want to switch back? Shift+Tab

For Pro, Max, and Team users, if no default permission mode has ever been set, they will receive an in-product notification, and new sessions will automatically start in auto mode; those who have set other defaults will see a one-time prompt. If a Team administrator has already specified a default in managed settings, they are unaffected.

To switch modes, press Shift+Tab in the CLI, or use the mode dropdown menu in the desktop app. Administrators can fix the organization-level default using defaultMode in managed settings, or completely disable auto mode using disableAutoMode.

Anthropic noted at the end of the announcement that auto mode relies on a classification system, which can reduce but not eliminate risk. For high-risk changes to production infrastructure, users are still advised to review Claude's actions themselves.

Risk Warning and Disclaimer

The market involves risks, and investment requires caution. This article does not constitute personal investment advice, nor does it consider the specific investment objectives, financial status, or needs of individual users. Users should consider whether any opinions, views, or conclusions in this article align with their specific circumstances. Investment based on this content is at the user's own risk.