Claude Code makes auto permissions default for Pro, Max, and Team on August 14

• Claude Code flips auto mode on by default for Pro, Max, and Team users on August 14, while pinned defaults remain unchanged, per ClaudeDevs' announcement.
• Anthropic says the classifier caught 89% of dangerous commands in a 1,053-tester study, versus 13.6% for humans reviewing permission prompts, according to ClaudeDevs' study note.
• Classifier overhead stops counting against Pro, Max, and Team usage limits now, and Enterprise plus API users get the same treatment when auto mode becomes their default, ClaudeDevs' overhead note says.
• The change is aimed at long-horizon agent runs, with ClaudeDevs' Opus 5 note describing multi-hour tasks and parallel sessions that return PRs for review.
• The sharp objection is residual risk: Kunchen Gui argued the remaining 11% means command review is the wrong security boundary, while ClaudeDevs' settings note says admins can pin another default or disable auto mode.

The official post says Teams and Enterprise auto-mode users ship about 25% more PRs and lists Adobe, Nuro, Gusto, and Garner Health as production defaults. Anthropic's older engineering writeup explains the weirder part: the classifier sees user messages and executable tool calls, but strips Claude's own prose and tool outputs. The auto-mode config docs add the migration gotcha: by default, the classifier trusts only the working directory and current repo remotes. A separate Scale X analysis of 40,000 approval-game runs found humans missed one in three threats.

Starting August 14, new Claude Code sessions on Pro, Max, and Team plans run in auto mode unless a user or admin already pinned another permission mode, according to Anthropic's launch post.

The same post says Enterprise, Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud Agent Platform, and Microsoft Foundry remain opt-in for now, with default rollout planned over the coming month. ClaudeDevs put the full post behind the thread's blog link.

The pricing part changed immediately: ClaudeDevs' overhead note says the classifier uses a small number of extra tokens per tool call, but that overhead no longer counts toward Pro, Max, and Team limits.

Auto mode routes each tool call through a classifier that targets actions Anthropic describes as irreversible, destructive, or aimed outside the user's environment, according to the launch post. When the classifier blocks an action, Claude either finds a safer path, asks the user, or falls back to manual approval after three consecutive blocks or twenty total blocks in a session.

In Anthropic's controlled study, 1,053 paid testers saw one permission prompt swapped for a clearly dangerous command. Humans blocked 143 of 1,053 commands, while auto mode blocked 937 of 1,053, and ClaudeDevs' study note says human detection fell to roughly 5% after 50 prior prompts.

The head-to-head result is the cleanest number in the post: auto mode blocked 800 commands humans approved, while humans blocked 6 commands auto mode allowed, per Anthropic's launch post.

Anthropic's launch post says Claude Code users approve 97% of permission prompts, while users reject 39% of plan approvals and only 3% of individual permission requests. The same post says 49.5% of active CLI users had manually created a Bash allow-rule as of June 2026, 62% had used bypassPermissions or clicked “don't ask again” on Bash, and 25% of interactive sessions start in bypass-permissions mode.

The external human-factors evidence points the same way. Scale X's browser-game analysis covered more than 40,000 runs and 409,000 approve-or-deny decisions, with average accuracy at 66.3% and 32.9% of sessions ending negative.

Scale X broke misses down by threat type:

• Obviously destructive commands: 11.7% miss rate.
• Persistent mutation: 23.8%.
• Exfiltration or code execution: 33.4%.
• Scope violations, such as credential or kubeconfig access: 35.0%.
• npm run analyze: 64.7%, the most-missed single command.

Boris Cherny described the defense as “model training + input probes + a classifier checking intent,” and Cherny's follow-up shortened the stack to “model, probes, and harness.”

Anthropic's launch post says Trajectory Labs tested 72 indirect prompt-injection scenarios, 10 attempts each, against Claude Code and Codex builds available on July 17, 2026. None of the 720 attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 in auto mode, while GPT-5.6 Sol in Codex Auto-review saw a 5.83% success rate and Full Access saw 19.03%, according to the launch post.

The caveat is in the footnote, not the chart. Cherny's footnote reply says Anthropic evaluated Claude Code v2.1.205 and Codex v0.144.5, and that OpenAI had released a newer Auto-review version that could change the results.

Anthropic's engineering writeup gives the architecture behind that claim:

• Input layer: a server-side prompt-injection probe scans files, web fetches, shell output, and external tool responses before they enter the agent context.
• Output layer: a transcript classifier evaluates tool calls before execution.
• Two-stage filter: a fast single-token block/allow pass escalates flagged actions to a reasoning pass.
• Classifier view: user messages plus tool calls, with Claude's prose and tool outputs stripped.
• Subagents: the same pipeline runs recursively, with delegation and return classifiers.

The buried permissions caveat is big: Anthropic says normal permission rules still fire before the auto-mode classifier, except broad allow rules that grant arbitrary code execution. The launch post gives python:* as an example of a rule set aside while in auto mode, with settings left unchanged and reactivated when the user switches modes.

The auto-mode config docs say explicit deny and ask rules still run before the classifier, and autoMode settings define trusted repos, buckets, domains, and internal services. By default, those docs say the classifier trusts the working directory and current repo remotes.

Claude Code's permission-mode docs describe the user-facing mode set:

• default: reads only.
• acceptEdits: reads, file edits, and common filesystem commands.
• plan: reads plus classifier-approved commands when auto mode is available.
• auto: everything with background safety checks.
• dontAsk: only pre-approved tools.
• bypassPermissions: everything, intended for isolated containers or VMs.

Boris Cherny also pointed users to live tuning paths: one reply says /permissions can tune the classifier after a bad block, while another reply says the allow list can be changed through Claude or settings.json.

Anthropic frames auto mode as infrastructure for long-running agents, not just fewer popups. ClaudeDevs' autonomy note says the default change makes multi-hour background tasks more viable because Claude runs longer between interruptions.

The production numbers are concrete. Anthropic's launch post says Teams and Enterprise users on auto mode ship about 25% more PRs, while the companion production post says Claude Code sessions run 9 times longer between interruptions.

Boris Cherny's own usage claim was blunter: Cherny said the team had used auto mode exclusively for months and could not imagine returning to permission prompts.

The main critique focused on boundaries. Gui's follow-up called 11% “not a small number,” and another Gui reply argued the safer primitive is a secured environment rather than confidence in a command classifier.

Mario Zechner made the permission-dialog point before the default change, linking his recommended reading to Scale X's approval-game data and calling permission prompts “security theater” for agents.

A separate Claude Code security thread hit Skills. David Breunig said Claude Code Skills can run shell commands through !<command> before skill content is sent to Claude, with commands running silently by default, and the linked drskill project added guardrails for that exploit surface.

The broader supply-chain version showed up in NanoClaw AI's warning about 440-plus poisoned npm packages from the August 4 keyv/cacheable worm, which it said hunted AI credential stores and planted persistence in Claude Code hooks.

The same news cycle included Claude Code 2.1.225, a 14-change CLI release. ClaudeCodeLog's changelog excerpt says the release added gateway spend-limit details to usage warnings, added a workspace trust prompt to claude agents for untrusted directories, and fixed auto mode's consecutive-block accounting when the safety filter refuses its own permission check.

The release also touched agent reliability plumbing: transient OAuth 401s, macOS MCP OAuth bursts, cross-session messages, Remote Control resume after very large compactions, self-hosted runner startup failures, and web sessions misreported as stuck.

The prompt surface grew too. ClaudeCodeLog's prompt-stats note says 2.1.225 added the claude-code-device model, increased bundle size by 407.7 KB, added 2 prompt files, and grew prompt tokens by 9,353, an 11.6% jump from 2.1.224.