AI Tools
Is Claude Code auto mode safe? What the August 14 change means
Claude Code auto mode becomes the default for Pro, Max, and Team plans on August 14, 2026. Anthropic's controlled study with 1,053 testers found auto mode caught 89% of dangerous commands, while human reviewers caught 13.6%. Here is what changes, what the safety data actually shows, and how to opt out.
What matters
- Auto mode becomes the default in Claude Code on August 14, 2026 for Pro, Max, and Team plans; Enterprise, the Claude API, AWS Bedrock, Google Cloud, and Microsoft Foundry stay opt-in for now.
- In Anthropic's 1,053-tester study, auto mode caught 89% of dangerous commands while human reviewers caught 13.6%; users currently approve 97% of permission prompts.
- Claude Code is included with Pro ($17/mo annual, $20 monthly), Max (from $100/mo), and Team plans (from $20/seat/mo annual).
- Press Shift+Tab in the CLI or use the desktop dropdown to switch modes; admins can pin or disable auto mode via defaultMode and disableAutoMode settings.
What is Claude Code auto mode?
Claude Code is Anthropic's command-line coding agent, and auto mode is a permission mode that removes per-command approval prompts. Instead of asking for each command, Claude Code routes every tool call through a classifier built to block actions that are irreversible, destructive, or aimed outside your environment. Per the official announcement dated August 7, 2026, starting August 14, new sessions on Pro, Max, and Team plans run in auto mode by default. If you already set a different default yourself, you get a one-time prompt asking whether to switch. A pinned default never changes.
When the classifier blocks something, Claude usually finds a safer way to proceed on its own or asks you directly. If it cannot make progress, after three blocks in a row or twenty across a session it falls back to manual approvals.
What the safety data actually shows
Anthropic's case for the change rests on evidence that manual review is mostly reflexive. Users approve 97% of permission prompts in Claude Code, and the rejection rate for individual permission requests is just 3%, versus 39% for full plans presented for approval. In a controlled study with 1,053 paid professional testers, human reviewers caught 13.6% of injected dangerous commands (143 of 1,053), while auto mode blocked 89% (937 of 1,053). Head to head, auto mode blocked 800 commands that a human approved; humans blocked only 6 that auto mode allowed.
Longer sessions made humans worse: reviewers blocked about 17% of dangerous commands early in a session, dropping to about 5% after 50 prior prompts, while auto mode's block rate stayed flat. In real usage from May to June 2026, manually approved sessions contained serious unintended harm more than twice as often as auto mode sessions: at production-level severity, 6.3% versus 2.4%. A two-week red-team engagement with Apollo Research cut the classifier's miss rate from 12% to 7% on adversarial sets.
Anthropic also commissioned Trajectory Labs to run 72 indirect prompt-injection scenarios, each tested 10 times, against current models. None of the 720 attacks succeeded against Claude models running auto mode. The same evaluation recorded a 5.83% attack success rate against GPT-5.6 Sol in Codex auto-review mode and 19.03% in Full Access mode. This is vendor-commissioned data, so treat the cross-vendor comparison as Anthropic's claim, not an independent benchmark.
How auto mode decides, and where it still stops
The classifier targets actions a reviewer would want to catch: irreversible operations, destructive commands, and anything that reaches outside your environment. Data exfiltration, such as sending code or secrets to an external destination, sits in a hard-deny category the classifier never approves. To run that kind of action you must switch out of auto mode or execute it yourself. Hard-deny rules are customizable per organization via settings.
Two limits are worth knowing before you trust it. First, existing permission rules still fire before the classifier, except allow rules broad enough to grant arbitrary code execution (for example Bash python:*), which are set aside while auto mode is active. Settings files are not modified, and those rules apply again the moment you switch modes. Second, Anthropic's own guidance is blunt: auto mode "relies on classification systems and therefore does not eliminate risk." For high-stakes changes to production infrastructure, Anthropic still recommends reviewing Claude's actions yourself.
Who should keep manual review, and who benefits from auto mode
Keep manual (or plan) mode if you manage high-stakes production infrastructure, run in regulated environments, or simply want to see every command before it executes. Auto mode is a productivity default, not a control policy. On Claude Enterprise, the Claude API, AWS Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry it remains opt-in for now, with a plan to make it the default within the coming month; Enterprise admins can already set it via managed settings.
For long-running agentic work, the change is substantial. Auto mode users among Teams and Enterprise adopters ship about 25% more pull requests, according to Anthropic, and models built for long tasks such as Claude Opus 5 become practical to leave running for hours. Adobe's merchandising platform team, Nuro, Gusto, and Garner Health already run auto mode as their production default. Gusto reports about 10% of sessions since mid-May include a classifier denial, which the company cites as evidence the guardrails are active.
Claude Code pricing: what auto mode costs
Claude Code is included in every paid Claude plan. Per the official pricing page: Pro is $17 per month billed annually ($200 up front) or $20 billed monthly; Max starts at $100 per month; Team is $20 per seat per month billed annually ($25 monthly) for a standard seat, with premium seats at $100 per seat per month annually ($125 monthly). A free tier exists with no Claude Code access.
The auto mode classifier uses a small number of extra tokens per tool call, and Anthropic stopped charging Pro, Max, and Team users for that classifier overhead effective August 7, 2026. Enterprise and API access still pay for classifier overhead today, with a plan to drop that charge as auto mode rolls out to those surfaces.
How to turn Claude Code auto mode off
Switching is quick: press Shift+Tab in the CLI or use the mode dropdown in the desktop app to cycle to another permission mode. For a persistent default, set defaultMode in your settings file. Per the Claude Code settings reference, valid values include default, acceptEdits, plan, auto, dontAsk, and bypassPermissions. Note that auto is ignored in project or local settings, so a repository cannot grant itself auto mode; set it in ~/.claude/settings.json instead.
Admins pinning an org-wide policy can set defaultMode in managed settings, or set disableAutoMode to remove auto from the Shift+Tab cycle entirely and reject --permission-mode auto at startup. If your team's workflow depends on hand-curated command allowlists, keep in mind auto mode sets aside arbitrary-code-execution allow rules (like Bash python:*) while active, then restores them when you switch back.
At a glance
| Auto mode (new default) | Manual review | |
|---|---|---|
| Permission prompts | None: classifier checks each tool call | Every tool call prompts the user |
| Dangerous commands caught (1,053-tester study) | 89% blocked | 13.6% caught by reviewers |
| Prompt injection (Trajectory Labs eval) | 0 of 720 attacks succeeded | Not measured in the eval |
| Fallback behavior | Manual approvals after 3 blocks in a row or 20 per session | Always manual |
| Classifier cost | Free on Pro, Max, and Team | No classifier used |
FAQ
Is Claude Code auto mode free?
Yes for paid users. Auto mode is included with Pro, Max, and Team plans, and Anthropic stopped charging those plans for the classifier's token overhead on August 7, 2026. Enterprise and API access still pay the overhead for now.
How do I turn off Claude Code auto mode?
Press Shift+Tab in the CLI or use the mode dropdown in the desktop app. For a persistent change, set defaultMode in ~/.claude/settings.json (auto is ignored in project and local settings). Admins can use disableAutoMode in managed settings to remove it org-wide.
Does Claude Code auto mode work on Enterprise and the API?
Not as a default yet. Auto mode remains opt-in on Claude Enterprise, the Claude API, AWS Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry. Anthropic plans to make it the default across these within a month of the August 7, 2026 announcement.
Related reading
Claude Code vs Mimocode, Cursor vs GitHub Copilot, Claude tool profile, Radar index