Claude Code makes auto mode the default on August 14: humans caught 13.6% of dangerous commands, the classifier caught 89%

Anthropic makes auto mode the default setting in Claude Code for Pro, Max, and Team plans starting August 14, 2026. Auto mode routes every tool call through a classifier that blocks irreversible, destructive, or environment-escaping actions instead of asking a human to approve each step. In a controlled experiment with 1,053 paid testers published by Anthropic, humans rejected only 13.6% of a planted dangerous command (143 of 1,053) while the auto mode classifier blocked 89% (937). ASAP works from Anthropic's official announcement to separate what this transition automates from what it does not.

What changes on August 14 and what does not

The default switch reaches Pro, Max, and Team plans on August 14, 2026, while Enterprise remains opt-in for now. Anthropic states that Enterprise will move to the same default within a month. Environments where a user or an administrator has already pinned a mode are unaffected by the change.

Approval does not disappear under auto mode. Anthropic names three categories that still stop and ask. The first is anything hitting a hard deny rule, where sending code or secrets outside the environment is never auto-approved. The second is any action that explicitly requests privilege escalation beyond its granted scope. The third is a destructive git operation attempted while uncommitted work is present.

Auto mode also retreats on its own when blocks accumulate. Anthropic states that three consecutive blocks or twenty total blocks in a session return the session to manual approvals. Users switch modes with Shift+Tab in the CLI or a dropdown on desktop, and organization administrators can pin the default through defaultMode in managed settings or shut the feature off entirely with disableAutoMode. The classifier's compute overhead is no longer billed to Pro, Max, and Team users.

The 1,053-person experiment measured attention, not judgment

Anthropic's controlled experiment gave 1,053 paid professional developers a working coding environment, swapped one ordinary permission prompt for a plainly dangerous command, and recorded only whether the participant noticed and refused it. Humans refused 13.6% of the time and the classifier blocked 89%. In the head-to-head comparison on identical commands, the classifier blocked 800 commands that humans had approved, while humans caught just 6 that the classifier let through.

The most consequential number in this experiment is not the average but the trend over time. Early in a session, human block rates ran around 17%, falling to roughly 5% after 50 or more prior prompts. Classifier block rates stayed flat regardless of session length. Human vigilance erodes to about a third of its starting level as a session runs long.

Production data points the same direction. Anthropic analyzed real sessions from May and June 2026 and reports unintended harm at severity 7 or above in 6.3% of manually approved sessions against 2.4% of auto mode sessions. Internal incidents the classifier prevented include a fallback connection that would have leaked data off-network, a mass process kill across roughly 2,000 pods paired with a GPU deletion queue, and an over-broad privilege escalation requesting an administrative role in place of read-only access.

The 97% approval rate says the permission prompt had already collapsed

The most contested evidence in this announcement is not the human-versus-machine comparison but the behavioral statistics. Anthropic reports that Claude Code users approve 97% of permission prompts. Among CLI users, 49.5% have written their own allow-rules, 5% allow any shell command whatsoever, and 62% have used bypassPermissions or clicked "don't ask again," effectively turning approval off.

Placing those numbers side by side changes the character of the transition. Making auto mode the default is less a decision to replace human oversight with machine oversight than a decision to replace an oversight ritual that had stopped functioning with a filter that actually fires. At a 97% approval rate, the permission button is not a risk filter but a source of friction in the work loop, and 62% of users had already routed around it.

Alert fatigue reproduces itself precisely here. When 100 prompts appear and one of them is dangerous, a person spends the other 99 learning that "approve" is the correct reflex. The curve from 17% early to 5% after 50 prompts is that learning process rendered as data. The classifier wins not because its judgment is better but because it does not tire, which is also why the experiment recorded noticing rather than accuracy.

Inverting the argument produces an uncomfortable corollary. A large share of why approval collapsed traces back to the product decision that surfaced prompts that frequently in the first place. The party that created the friction and the party proposing automation to remove it are the same, and that is a condition worth stating whenever these numbers are cited.

The remaining 11% is a different kind of miss than the human 11%

An 89% block rate also means 11% of dangerous commands pass through. Anthropic states the limit directly in the announcement: "While we believe auto mode reduces risk for most users, it relies on classification systems and therefore does not eliminate risk," and recommends reviewing Claude's actions directly for high-stakes changes to production infrastructure.

What deserves attention is that the two failure sets have different shapes. The 11% a human misses comes from divided attention, so it is close to random and varies by person. The 11% a classifier misses comes from a learned decision boundary, so it is deterministic, and the same class of command passes identically in every user environment. Individual incident probability falls while the correlation between incidents rises, which is the real trade being made.

Adversarial testing supports that reading. In red-team evaluation by Apollo Research, the classifier's initial miss rate was 12%, dropping to 7% on a held-out attack set after hardening. Prompt injection was measured separately. Trajectory Labs ran 72 scenarios ten times each and found a 0% attack success rate against Claude Fable 5, Opus 5, and Sonnet 5 in auto mode, against 5.83% for GPT-5.6 Sol under Codex auto-review.

These figures leave something unsaid. A 0% success rate holds within the 72 scenarios tested, and the next generation of attacks, designed with the classifier's existence as a premise, is not in that sample. When the defensive line moves from human eyes to a single classifier layer, the attacker's target moves from fooling a person to fooling a model.

What engineering organizations should decide before August 14

The practical implication is that the decision deadline is now fixed. After August 14, taking no action is itself a choice to run auto mode, so any organization on Pro, Max, or Team plans should review managed settings before that date. The options are pinning an organization default through defaultMode, blocking the feature with disableAutoMode, or accepting the new default as delivered.

Hard deny rules deserve the first pass. Because these rules are customizable in settings, an organization that accepts auto mode should first encode its own secret storage paths and prohibited external destinations as rules. Anthropic states that the classifier consults repository visibility and git status before destructive operations and checks whether a git push target is public or private, which means repository visibility settings feed directly into live risk decisions.

Some areas should wait. Anthropic itself recommends manual review for high-stakes changes to production infrastructure, so deployment pipelines, production databases, and repositories handling payments or personal data are better served by pinning manual mode. Organizations whose internal controls require a human approval record in the change log should verify how that requirement interacts with a mode that removes the record.

One adoption number is worth borrowing as a baseline. Gusto, the payroll company Anthropic cites, reports that roughly 10% of its sessions include a classifier denial. One session in ten sees the classifier actually intervene, which gives organizations a reference point after enabling auto mode. A rate far above that signals the underlying workflow needs attention, and a rate near zero signals the classifier is doing nothing at all.

This transition will be judged on records, not on incidents

The real safety of auto mode will be settled by the record-keeping that makes incidents visible, not by the incidents themselves. Anthropic's 6.3% versus 2.4% comparison is the company's own analysis of its own session data, and the method behind the severity-7 threshold is not published. No external party can currently reproduce that comparison.

Accountability remains unsettled as well. Harm following a human approval click and harm following a classifier pass are treated differently inside an organization. Whether classifier decision logs fill the space vacated by approval records, and whether an organization can export those logs for audit, directly determines viability in regulated industries.

The largest variable is the Enterprise transition. Anthropic plans to move Enterprise to the same default within a month, and where Pro and Max describe individual developer environments, Enterprise describes environments carrying regulatory and audit obligations. Whether an 89% figure derived from 1,053 individual users carries the same meaning in financial, medical, and public-sector development environments will be answered as that transition proceeds.

Source: Anthropic official announcement, Auto mode is now the default in Claude Code for Pro, Max, and Team plans (effective 2026-08-14), and TechCrunch reporting (2026-08-09). Compiled by ASAP.