Claude Code Will Auto-Approve Most Commands by Default Starting August 14

What happened

Starting August 14, new Claude Code sessions on Pro, Max, and Team plans will default to “auto mode” instead of asking you to approve each command before it runs. Anthropic explains the change as replacing a person clicking approve on every step with a classifier, a separate small model that reviews each action Claude wants to take and decides in real time whether it’s safe to run without asking you first.

Auto mode blocks anything the classifier judges irreversible, destructive, or reaching outside your project, such as deleting files it can’t recover or sending data somewhere external. It only pauses to ask you when it isn’t confident. If the classifier keeps blocking things, it gives up on running unattended: three blocked actions in a row, or twenty blocked actions total in one session, and Claude Code falls back to asking your approval before every command for the rest of that session.

The classifier itself uses a small amount of extra tokens (the units Claude Code’s usage limits are measured in) on every command it reviews. As of today, that overhead no longer counts against your usage limit on Pro, Max, or Team plans.

Enterprise, the Claude API, and cloud platforms (AWS Bedrock, Google Cloud’s Agent Platform, Microsoft Foundry) keep auto mode opt-in for now. Anthropic says it plans to make it the default there too within the next month.

If you’ve already set a different default permission mode yourself, you’ll get a one-time prompt on August 14 asking whether to switch. If you’ve pinned a default, meaning you or your admin explicitly locked it in your settings, nothing changes for you automatically.

Why it matters

Anthropic’s case for the switch rests on a claim worth taking seriously and checking yourself: manual approval, as most people actually use it, isn’t doing much reviewing. The company’s own usage data shows users approve 97% of permission prompts and reject only 3% of individual command requests. People do scrutinize the bigger picture more: they reject 39% of multi-step plans Claude proposes upfront. But once a plan is approved, the step-by-step prompts that follow get rubber-stamped.

That tracks with how many people had already stopped relying on prompts at all. As of June 2026, about half of people running Claude Code from the terminal had written a custom rule pre-approving whole categories of commands, and 62% had used the full bypass mode or clicked “don’t ask again” on Bash, Claude Code’s tool for running terminal commands on your machine, at some point. A quarter of interactive sessions now start in bypass mode by default already. For a lot of builders, manual review had quietly become optional well before Anthropic made this change official.

To test whether a classifier does better, Anthropic ran a controlled study with 1,053 paid testers: each saw a permission prompt for a command that was, unknown to them, actually dangerous (nothing was executed). Only 143 testers, 13.6%, caught it and rejected the prompt. Run through the auto mode classifier instead, the same set of commands got blocked 937 times, 89%. In a separate review of real production sessions flagged by Anthropic’s safety pipeline, drawn only from accounts that had opted into data use for training, manually approved sessions contained a seriously harmful action the user hadn’t asked for 6.3% of the time, versus 2.4% for auto mode sessions.

Anthropic also had a third-party firm, Trajectory Labs, test how auto mode holds up against prompt injection: text an agent reads, like a webpage or a task description, that tries to trick it into doing something the user didn’t intend. None of 720 injection attacks succeeded against Claude models running auto mode. The same attack set succeeded 5.83% of the time against OpenAI’s GPT-5.6 Sol running Codex’s own auto-approval mode, and 19.03% of the time against a fully unrestricted “Full Access” mode.

None of this means the classifier is infallible. It’s a model making judgment calls, and it will get some wrong, especially on genuinely unusual commands it hasn’t seen a pattern for. In a two-week red-teaming pilot with Apollo Research, an AI safety research group that injected synthetic attacks into real coding sessions, the classifier’s miss rate started at 12% and fell to 7% after tuning. That’s a real improvement over what most people were already doing, not a guarantee nothing slips through. Treat these numbers as Anthropic’s own comparison, not an independent audit, and verify your own setup instead of assuming the new default fits how you work.

Who should care

This affects anyone running Claude Code on a Pro, Max, or Team plan with Bash access to run real terminal commands, which is most people using it for more than writing code by hand. It lands especially close to home if you followed our recent coverage of Claude Code’s second permission bypass patch two days ago and the first one four days before that: those fixes hardened the manual approval prompt that’s now stepping aside as the default for most users.

Team admins who need manual review for compliance or internal policy reasons should act before August 14, since the default will otherwise switch under their organization automatically. Enterprise, API, and cloud-platform users aren’t affected yet, but should expect the same default change within about a month.

What builders should do next

Check which mode you’re actually running before August 14 instead of assuming. Press Shift+Tab in the terminal, or use the mode dropdown in the desktop app, to see and cycle through your current setting. Don’t rely on memory of how you set it up originally, since a teammate or an earlier version could have changed it.

If auto mode’s tradeoffs work for you, you don’t need to do anything: new sessions will just start there on August 14 instead of at today’s manual default. If you want to keep manual approval, whether for a personal preference or a compliance requirement, pin it yourself by setting defaultMode in your Claude Code settings before August 14, or turn auto mode off entirely with disableAutoMode. Admins can set either option org-wide so it applies to every session on the team, not just their own.

The real story here isn’t that Claude got faster at saying yes. It’s that Anthropic’s own numbers show manual approval was already mostly theater for a large share of Claude Code users, who had quietly moved to allow-rules and bypass mode long before this became the default. Auto mode formalizes what a lot of builders were already doing informally, with a classifier that at least has to justify each call instead of rubber-stamping everything. Knowing that is worth more than the flip itself, even if you end up opting back out.

End of article