Claude Code makes Auto Mode default for paid users on Aug. 14

• Claude Code's default changes for paid coding users on Aug. 14: ClaudeDevs' blog link says new Pro, Max, and Team sessions move to auto mode unless a prior or pinned default blocks the flip.
• Anthropic's safety case rests on prompt fatigue: the dangerous-command study in ClaudeDevs' chart put human catches at 13.6% and auto mode at 89%.
• The classifier token tax is being waived on Pro, Max, and Team today, while ClaudeDevs' usage note says Enterprise and API users get the same treatment when auto becomes their default.
• The anti-prompt-injection claim is defense-in-depth: bcherny credited model training, input probes, and classifier intent checks in his thread.
• The messy edge case is long-horizon Opus 5 behavior, with venturetwins' video showing a runaway codegen session ending in a stack trace.

Anthropic's blog post buries the ugly permission-prompt stat: users approve 97% of Claude Code permission prompts, reject only 3%, and nearly half of active CLI users have created a Bash allow-rule. The production companion piece has Nuro running overnight agents from 10 p.m. to 5 a.m. and Gusto logging 2,425 Claude Code sessions from one engineer. The auto-mode config docs expose the ops layer: autoMode.environment, soft_deny, hard_deny, and claude auto-mode defaults are how teams teach the classifier what counts as inside their boundary. trq212's "defeating the lethal trifecta" joke points at Simon Willison's triad of private data, untrusted content, and external communication.

New Claude Code sessions on Pro, Max, and Team plans move to auto mode on Aug. 14. Anthropic's announcement says users who already set a different default may get a one-time prompt, while pinned defaults stay unchanged.

The staged rollout leaves several surfaces opt-in for now: Claude Enterprise, the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry. The same post says Enterprise admins can already make auto mode the default through managed settings, with a broader default rollout planned across those platforms in the coming month.

ClaudeDevs also said the switch remains reversible inside the app: the rollout note says users can cycle modes with Shift+Tab, and admins can pin defaultMode or disable auto mode in managed settings.

Anthropic's controlled study used 1,053 paid professional testers in a coding environment. [ClaudeDevs' thread] gave the headline result: humans caught 13.6% of dangerous commands, while auto mode blocked 89% and stayed flat as sessions got longer.

Anthropic's blog post adds the behavioral backdrop:

• Users approve 97% of Claude Code permission prompts.
• Users reject 39% of Claude plan approvals, but only 3% of individual permission requests.
• As of June 2026, 49.5% of active CLI users had manually created a Bash allow-rule.
• 5% allow any shell command outright.
• Another 43% use interpreter rules such as Bash(python:*) or Bash(node:*), which Anthropic describes as effectively equivalent in practice.
• 62% have used bypassPermissions or clicked "don't ask again" on Bash.
• 25% of interactive sessions start in bypass permissions mode.

The sharpest number is the decay curve: testers caught about 17% of dangerous commands early, then about 5% after 50 prior prompts, according to the same blog post.

Auto mode routes each tool call through a classifier aimed at irreversible, destructive, or out-of-bound actions. Anthropic's announcement says that when the classifier blocks something, Claude usually tries a safer route or asks the user directly.

The failure path is explicit:

• Three blocks in a row, manual approvals return.
• Twenty blocks across a session, manual approvals return.
• Permission rules still fire before the classifier.
• Broad allow-rules that grant arbitrary code execution, such as python:*, are set aside while auto mode is active.
• Settings files are not modified, and those rules apply again when the user switches modes.

The cost change is immediate for paid consumer and team plans: ClaudeDevs' usage note says the classifier uses a small number of extra tokens per tool call, but that overhead no longer counts toward Pro, Max, and Team limits.

trq212 said Anthropic should have titled the post "defeating the lethal trifecta," a reference to the AI-agent risk pattern where a system combines private data, untrusted content, and external communication. Simon Willison's writeup is the clean definition of that triad.

bcherny described the protection stack as layered: model training, input probes, and a classifier checking intent in his thread. In a follow-up, bcherny's short answer compressed it to "a combination of model, probes, and harness."

Anthropic's announcement says Trajectory Labs tested 72 held-out indirect prompt-injection scenarios 10 times each. In that evaluation, no attack succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode, while GPT-5.6 Sol in Codex Auto-review had a 5.83% success rate and Full Access had a 19.03% success rate.

The Codex comparison has a timestamp: bcherny's footnote reply says the evaluation used Claude Code v2.1.205 and Codex v0.144.5, and notes that OpenAI had released a new Auto-review version the prior week that could change results.

bcherny also kept the human accountability line in the thread: security is every engineer's job, he replied.

Anthropic says Team and Enterprise auto-mode users ship about 25% more PRs, according to its announcement. The production examples are more useful than the percentage.

Anthropic's production post gives three workflows:

• Nuro: Kai Zhou runs three or four auto-mode sessions in parallel, uses it for 100% of his coding work, and described a 10 p.m. to 5 a.m. run that produced three PRs.
• Gusto: Martin Emde has started 2,425 Claude Code sessions since December, and Gusto's analysis found roughly 10% of session transcripts since mid-May 2026 included an auto-mode denial.
• Garner Health: Claude Code rolled out to all 550 employees, with workers encouraged to spend about two hours a week automating repeatable work across systems including Salesforce, Zendesk, and Snowflake.

The Garner workflow reads like a real agentic SDLC: skills standardize the process, the agent explores context, commits context files, runs "antagonistic research" against its assumptions, then moves to implementation.

Claude Code exposes the control surface in docs and in bcherny's replies. If auto mode blocks a command incorrectly, bcherny's reply says /permissions can tune the classifier.

The same reply chain points to persistent settings: bcherny's settings.json note says users can ask Claude to add to the list or edit settings.json themselves, while another bcherny reply names /permissions as the way to allow a command forever next time.

The permission-mode docs list the relevant modes:

• default: reads only.
• acceptEdits: reads, file edits, and common filesystem commands.
• plan: reads, plus classifier-approved commands when auto mode is available.
• auto: everything, with background safety checks.
• dontAsk: only pre-approved tools.
• bypassPermissions: everything, for isolated containers and VMs.

The auto-mode config docs add the team-level boundary model: autoMode.environment names trusted repos, source control, internal domains, buckets, services, package registries, sensitive data locations, and protected infrastructure scopes. The classifier does not read autoMode from project .claude/settings.json or .claude/settings.local.json, because a repository or build step could otherwise inject its own allow rules.

For debugging rabbit holes, bcherny's safe-mode reply points at claude --safe-mode, with CLAUDE.md or skills as likely causes if the behavior stops there.

The rollout is landing in the same week as messy Opus 5 anecdotes. venturetwins posted a video of an Opus 5 session generating repetitive code until it hit a large stack trace in the clip.

venturetwins also shared a chart of the first-run emotional arc: excitement, "it's doing too much," then "WTF is it doing" in the follow-up.

A Hacker News thread split the same way: one commenter described months of auto-mode sysadmin work over SSH without catastrophe, while another said a coworker's TDD run triggered a test that ran rm -rf on a home directory. Those anecdotes target agent behavior, while Anthropic's safety claim targets command gating.