- From 14 August 2026, Claude Code runs in auto mode by default on Pro, Max and Team plans, so the tool acts without asking unless a safety classifier stops it.
- The number that justifies the change is not about models. Anthropic reports that people approve 97 percent of the permission prompts they are shown.
- In a test with 1,053 paid testers, manual review caught 13.6 percent of dangerous commands and the classifier caught 89 percent.
- Human factors research has said the same thing since 2010: monitoring an automated process is a task humans are bad at, and practice does not fix it.
- The lesson for a small business is not to trust a vendor classifier. It is to stop treating a click as a control, and to write down which actions are irreversible for you.
If you run any AI tool that touches your files, your inbox or your storefront, you have seen the little box. Claude wants to run this command. Allow once, allow always, deny. Most people click allow. Anthropic has now put a figure on how most: 97 percent of permission prompts get approved, according to the company's own product data reported by TechCrunch on the auto mode default. On 14 August 2026 the company stopped showing most of those boxes.
That is a product change inside a developer tool, and if it stopped there it would not be worth your time. It does not stop there. The reasoning behind it applies to every AI agent a one person business is about to switch on, whether that is a support bot with refund powers, a scheduler with calendar write access, or a builder agent with commit rights to the repository that holds your shop. One of them has already run in public: the assistant that cancelled a stranger's gym booking did it by finding the one write call nobody had protected. The question underneath is old and it is not technical: what is a human approval actually worth once you are asked for a hundred of them a day?
What exactly changed on 14 August 2026?
Auto mode became the default permission mode for new Claude Code sessions on the Pro, Max and Team plans. Enterprise and API customers keep the old behaviour for now, with the same switch flagged for them within a month. Anthropic published the details in its note on making auto mode the default, which also drops the token charge for the classifier that auto mode runs.
The mechanism is worth stating precisely, because most coverage compressed it into "the agent now does what it wants" and that is wrong. Every tool call still passes a check. What changed is who performs the check. Previously it was you, in a modal dialog, with no context beyond a command string. Now it is a classifier that reads the call and blocks anything it judges irreversible, destructive, or aimed outside your environment. When the classifier blocks something, the agent can try a safer route or fall back to asking. Three consecutive blocks, or twenty in a session, and the whole session reverts to manual approval.
Claude Code's own documentation on choosing a permission mode lays out the ladder these modes sit on, and reading it is the fastest way to understand what the default actually moved. The ladder is short.
| Mode | Runs without asking | Who judges risk | Sensible use |
|---|---|---|---|
| default (manual) | Reads only | You, per action | Work on systems you cannot restore |
| acceptEdits | Reads, file edits, common filesystem commands | You, at the review stage | Iterating on code you read afterwards |
| auto | Anything a classifier judges reversible and in scope | A classifier, per call | Everyday work in a sandbox or a repo with clean git state |
| bypassPermissions | Everything | Nobody | Throwaway containers only |
Notice that the interesting distinction is not how much freedom the agent gets. It is who is doing the judging, and how well suited they are to the job.
One phrase in the policy deserves unpacking, because it carries most of the weight. Aimed outside your environment is the clause that separates a mistake from an incident. Deleting a file in a project folder is contained damage. Posting that file to a URL is not, because the recipient keeps a copy whatever you do next. The classifier treats the boundary of your machine or your sandbox as the important line, which is a sensible default and a poor description of a business, where the boundary that matters is usually the one between your systems and your customers.
Why did human review only catch 13.6 percent?
Because reviewing a stream of near identical prompts is a monitoring task, and humans are poor at monitoring tasks. In the test Anthropic ran with 1,053 paid testers, manual review caught 13.6 percent of dangerous commands while the classifier caught 89 percent. In real production sessions the company measured serious unintended harm at 2.4 percent under auto mode against 6.3 percent under manual approval, so the effect survived contact with real work rather than living only in a lab.
This surprises people who assume that a human in the loop is a safety feature by definition. The research disagrees and has for a long time. Parasuraman and Manzey's 2010 review in Human Factors, Complacency and bias in human use of automation, sets out the two failure modes precisely. Automation complacency is the drop in vigilance that follows trust in a system that has been right many times before. Automation bias is the tendency to accept a recommendation without cross checking it against information you already have.
Two findings from that review matter more than the definitions. The first is that complacency shows up under multi task load, which is the permanent condition of anybody running a business alone. The second is the uncomfortable one: neither complacency nor automation bias is fixed by training, instructions or practice. Experts show it as reliably as novices. If you have ever told yourself that you will read the prompts more carefully from now on, that review is the paper explaining why you will not.
The 97 percent approval rate is not evidence that users are careless. It is evidence that the design asked them for something people cannot supply: sustained attention to a repetitive check with a very low base rate of genuine danger.
Is a classifier actually safer, or just faster?
Safer on the measured axis, and the measurement is more honest than most vendor safety claims because it reports what got through. The eleven percent that auto mode missed is stated, not buried. Simon Willison, writing about the auto mode default and what it does not solve, takes exactly that number as his starting objection. He accepts that confirmation fatigue makes human approval unreliable. He does not accept that a detector solves the class of attack he considers most likely, which is a malicious dependency carrying setup instructions written to look ordinary.
His preferred answer is architectural rather than detective: limit what the agent can reach at all, so that a successful trick has nothing valuable within arm's length. That is the same conclusion we reached looking at how prompt injection defeats a coding agent, and it is worth holding onto, because it is the part of this story that transfers to a business that will never open a terminal.
The injection numbers themselves are strong. Third party testing by Trajectory Labs ran 72 indirect injection scenarios, 720 attempts in total, and reported no successes against Claude Fable 5, Opus 5 or Sonnet 5 under auto mode, against a 5.83 percent success rate on competing systems. Strong is not the same as finished. We looked at a larger study in what six thousand prompt injection attacks revealed, and the pattern there was consistent: defences hold against the attacks they were built against, and the interesting attacks are the ones nobody has written down yet.
What does this change for a business that is not writing code?
More than it looks, because the permission prompt is spreading. Support tools now ask before issuing a refund. Inventory tools ask before adjusting a count. Marketing tools ask before publishing. Every one of those is the same design, and every one of them is heading for the same 97 percent.
The useful move is not to pick a side between clicking and not clicking. It is to sort your own actions into three buckets and stop pretending the middle one needs your attention.
| Bucket | Test that puts an action here | Examples in a small shop | Right control |
|---|---|---|---|
| Reversible | You can undo it in under a minute with no cost to anyone outside the business | Draft a product description, edit a local file, tag an order, build a preview | No prompt. Let it run and review the result. |
| Recoverable at a cost | Undoable, but the undo costs money, time or a small amount of trust | Send one customer email, change a live price, push a commit to a branch | A log you actually read, plus a daily digest. Not a modal. |
| Irreversible | Somebody outside the business sees it, or the old state is gone | Issue a refund, delete a database, email your whole list, rotate a key, publish to a domain | A hard rule that blocks it outright, not a prompt you can click through |
That third column is the one worth writing down this week, because it is specific to you and no vendor classifier knows it. A classifier trained on general software risk knows that rm is dangerous. It does not know that your Tuesday newsletter goes to eleven thousand people and cannot be recalled, or that your supplier reads the shared inventory sheet within the hour. Anthropic's own answer to this is customisable hard deny rules, and the reason those exist is precisely that the general classifier cannot guess your irreversible list.
Where do agent credentials fit into this?
They are the part that decides how bad a mistake can get, and they are almost always over provisioned. An agent that can only read your catalogue cannot leak your customer list, regardless of what a classifier decides. An agent holding a service role key can do anything the key can do, and the classifier is the only thing between a bad instruction and a bad outcome.
This is the least glamorous work in the whole subject and the highest leverage. We went through it in detail in the keys your AI tools hold that nobody is watching, and the short version is that most small businesses have handed at least one AI tool a credential far broader than the job requires, usually because the narrow one took twenty minutes to create. If you want to understand how MaShop scopes what a build agent can touch and what stays out of its reach, our security page sets out the boundaries we hold ourselves to.
There is a second reason to start with credentials rather than settings. Permission modes are per tool and they change without asking you, as this week demonstrated. A credential is yours. When a vendor flips a default, the blast radius of that decision is defined by what you handed over months earlier, not by whichever dialog the vendor has decided to show or hide today. Every hour spent narrowing a key keeps paying out across every future default you will not be consulted about.
The production figures make the same point from the other direction. Auto mode sessions carried serious unintended harm at 2.4 percent, manual sessions at 6.3 percent. Both numbers are far from zero. A rate of one bad outcome in forty sessions is fine when the worst case is a reverted commit and completely unacceptable when the worst case is a refund issued to the wrong customer. The mode did not decide that. Your credential did.
Does removing the prompt remove your responsibility?
No, and this is where the change deserves scrutiny rather than applause. A permission prompt is a bad safety control, but it is a very good liability transfer. Every click was a record that a human said yes. Take the clicks away and the record goes with them.
What should replace it is not another dialog. It is a log you can read after the fact, at a size a person will genuinely read, and a rollback path you have tested at least once. Git gives you both for code, which is why the auto mode argument is strongest inside a repository with a clean working tree and weakest anywhere else. A live storefront, a payment provider or a customer inbox does not come with git. If you are running an agent against one of those, the burden is on you to build the equivalent before you turn the prompts off.
Boris Cherny, who leads Claude Code, said the team has run in auto mode exclusively for months and cannot imagine returning to permission prompts. That is a genuine signal about how the tool behaves day to day. It is also a signal from people working inside version controlled repositories on machines they can reimage, which is the best case for this design and not the case most readers are in.
A short sequence to run this week
None of this needs a project. It needs an hour and a text file.
- List every AI tool holding a credential. Include the ones you set up once and forgot. The forgotten ones are the risk.
- For each, write what it can reach. Not what it is used for. What the credential permits. These are usually different by a wide margin.
- Write your irreversible list. Five to ten actions, in your own words, specific to your business. Anything a customer sees, anything involving money, anything that destroys the previous state.
- Configure denials, not prompts. If the tool supports deny rules, put the irreversible list in them. If it does not, remove the permission at the credential level instead.
- Pick one place to read the log. A daily digest you read for a week beats a real time feed you read for a day.
Then let the reversible work run unattended, which is the part auto mode gets right. The gain from an agent is almost entirely in the reversible bucket, and that is where the interruptions were costing you.
The part to keep after the news fades
Anthropic will iterate on the classifier, other vendors will ship their own, and by next year the specific numbers in this article will be a historical footnote. The finding underneath them will not move, because it is about people rather than models.
Approval clicks are not oversight. They feel like oversight, they document like oversight, and they measure at 13.6 percent. Any control that depends on a human staying alert through a hundred repetitions of an almost always safe decision is a control that has already failed, and the human factors literature said so a decade and a half before an AI lab put a number on it. The thing to build instead is a boundary that does not need your attention to hold: a credential that cannot do the dangerous thing, a deny rule that does not offer an override, a log you read once a day when you are actually paying attention.
That advice is dull, cheap and older than every model mentioned here. It is also the only part of the story that will still be true when the next default flips.