Auto mode is now the default in Claude Code for Pro, Max, and Team plans

What happened

Auto mode is now the default in Claude Code for Pro, Max, and Team plans

Anthropic announced on August 8, 2026, that auto mode will become the default setting for new Claude Code sessions across its Pro, Max, and Team subscription tiers starting August 14th. The shift from opt-in to opt-out is notable because it signals that Anthropic has decided the behavior is robust enough to be the out-of-the-box experience for the broad paying user base rather than a feature reserved for those willing to experiment. The announcement came alongside the publication of evaluation data that Anthropic had been building toward since at least a public conversation at the AI Engineer World's Fair in July, where Anthropic team members Cat Wu and Thariq Shihipar said that broadly within Anthropic, almost every single person already uses auto mode.

The technical detail

The core mechanical shift is that auto mode removes the per-action confirmation prompt that Claude Code previously surfaced before executing commands or tool calls. Instead of pausing to ask the developer whether it can run a shell command, write a file, or invoke an API, the model takes autonomous action and makes its own judgment about whether a proposed action is safe or clearly dangerous. The safety evaluation is handled in-model rather than by a separate classifier or rules layer, meaning the frontier model itself is doing real-time risk assessment on every tool use during a session, not a secondary gating mechanism.

The justification for removing human checkpoints rests on a concrete number from a controlled study. Anthropic ran a test across 1,053 paid developers in which, partway through a session, a single clearly dangerous command was injected in place of a routine permission prompt. Only 13.6 percent of human reviewers refused that harmful action. Auto mode, by contrast, blocked 89 percent of those same actions. That gap is the core empirical argument: the human in the loop who is clicking through repeated confirmations is not actually providing meaningful safety review; confirmation fatigue erodes the behavior that the approval interface was designed to produce.

Why it matters for builders

The prompt injection numbers are more striking. Trajectory Labs, a third-party evaluator commissioned by Anthropic, tested 72 indirect prompt injection scenarios held out from Anthropic's own training, run against the latest publicly available Claude Code and OpenAI Codex as of July 17, 2026. Across 720 attack attempts against Claude Fable 5, Opus 5, and Sonnet 5 running auto mode, zero succeeded. Trajectory Labs was testing indirect injection specifically, meaning instructions smuggled into content the agent reads rather than content supplied directly by the user. The comparison against Codex is implicit in the framing of the evaluation but not broken out with specific pass or fail counts in the public write-up.

For engineers building or evaluating agentic workflows, the practical shift is significant. The previous model of human-in-the-loop approval for coding agents was increasingly understood to be a UX placebo: developers learn the cadence of the prompt rhythm and approve without reading, much as users click through cookie consent dialogs. If auto mode's in-model safety judgment is actually more reliable than that approval loop, the engineering argument for shipping agentic pipelines without per-step interrupts becomes much stronger. The question stops being whether to remove interrupts and starts being whether this particular implementation handles your specific threat surface.

Market and competitive context

The competitive context involves Codex, which was included in the Trajectory Labs evaluation but appears to have fared differently given Anthropic's choice to foreground the comparison. OpenAI's coding agent has been competing with Claude Code directly across the same developer audience. Making auto mode the default rather than an advanced option is a product differentiation move: Anthropic is betting that developers who find constant approval prompts annoying will perceive Claude Code as the faster, more autonomous experience, while also now claiming the safety high ground with published external evaluation data.

The open question that survives the evaluation numbers is the scope of scenarios tested. Simon Willison, who noted the zero-attack result, also identified a class of attack that is harder to classify: a malicious package in a project's dependency tree or README instructs the agent to run a command as part of a legitimate-sounding workflow, for example fetching model files before running a test suite, where the package itself is the exfiltration vector rather than the instruction. Auto mode's ability to evaluate individual tool calls does not obviously block this class of attack because the instruction appears legitimate at every individual step. The model is being asked to execute a command a developer plausibly would run; the malice is in the package, not the syntax.

What to watch next

What to watch is whether the zero-success-rate claim on prompt injection holds as Claude Code usage grows and as adversarial researchers have access to the production system rather than a held-out evaluation set. Trajectory Labs tested 72 scenarios held out from Anthropic, but adversaries are not constrained to that scenario set. The 11 percent of harmful actions that auto mode also failed to block in the human-versus-auto comparison is a second number worth tracking: at scale, 11 percent of clearly dangerous commands passing through a system used by a large developer base is not a rounding error. Anthropic has said more evals are coming, and whether those address the supply-chain injection class of attack will determine how much weight security-focused engineering teams can place on the current benchmarks.