# Claude Code Makes Auto Mode the Default

Starting Aug 14, auto mode becomes the default for Claude Code Pro, Max, and Team. Safety testing: 89% dangerous-command catch rate vs. 13.6% for humans. Third-party eval: zero prompt injection successes in 720 attacks.

By Neomanex. Updated 2026-10-09.

Anthropic is making auto mode the **default** for Claude Code Pro, Max, and Team subscribers on **August 14, 2026**. This is the first agentic coding tool to ship autonomous execution as the normal interaction mode — not an opt-in beta. And the safety data backing it is the most comprehensive ever published: 1,053-person controlled study, third-party prompt injection red-teaming, and internal production analysis all point the same direction.

## What happened

Starting August 14, new Claude Code sessions on Pro ($20/mo), Max ($100/mo), and Team Premium plans will run in **auto mode by default**. Users who already set a different default get a one-time prompt asking whether to switch. Enterprise, API, and cloud-platform users stay opt-in for now — Anthropic plans to flip the default there in the coming month.

Two things ship alongside:

1. **Classifier overhead is now free** (effective August 7). The safety classifier that inspects each tool call no longer counts against your token usage. Anthropic is eating the compute cost.

2. **Enterprise admin controls** for rollout. Teams that adopted auto mode early shipped **25% more PRs** — and admins can control which users and repos get it via managed settings.

## Why it matters

This isn't a product tweak. It's the moment agentic coding sheds the "beta feature" label.

**The safety numbers are the story.** Anthropic hired 1,053 paid professional testers through a research vendor. Mid-session, a single permission prompt was swapped for a clearly dangerous command. Human reviewers caught the dangerous command **13.6%** of the time. Auto mode's classifier caught **89%** ([Anthropic](https://claude.com/blog/auto-mode-default-in-claude-code), 2026). That's 800 dangerous commands that a human approved but the classifier blocked.

Critically, auto mode's block rate stayed flat regardless of session length, while human catch rates dropped from ~17% early to ~5% after 50+ prior prompts. Confirmation fatigue is real — and it gets worse the longer a session runs.

**Real-world production data** reinforces the controlled study. From May–June 2026, Anthropic examined flagged sessions from opt-in accounts and re-graded them on a 0–10 harm-severity scale. At production-level severity (7+), 6.3% of manually approved sessions contained serious unintended harm the user hadn't asked for, compared to 2.4% of auto-mode sessions ([Anthropic](https://claude.com/blog/auto-mode-default-in-claude-code), 2026).

**The prompt-injection results are the strongest signal.** Trajectory Labs ran an independent adversarial evaluation: 720 prompt injection attacks across 72 scenarios, held out from Anthropic, against Claude Fable 5, Opus 5, and Sonnet 5 in auto mode. **Zero attacks succeeded.** The same suite against GPT-5.6 Sol + Codex Auto-review mode achieved a 5.83% success rate ([Anthropic](https://claude.com/blog/auto-mode-default-in-claude-code), 2026).

**Simon Willison called it right — cautiously.** Willison, who [predicted a "challenger disaster for coding agents security"](https://simonwillison.net/2026/Jan/8/llm-predictions-for-2026/#1-year-a-challenger-disaster-for-coding-agent-security) for 2026, [wrote](https://simonwillison.net/2026/Aug/8/auto-mode/) that he would "dearly like to be proved wrong." But he's not declaring victory. He flags the 11% of dangerous commands auto mode still misses and warns that attacks using malicious third-party packages — where the classifier can't easily distinguish legitimate from malicious — remain an open concern. His preferred solution: OS-level sandboxing that deterministically restricts what agents can access, rather than relying solely on a classifier ([Simon Willison](https://simonwillison.net/2026/Aug/8/auto-mode/), 2026). Deny rules still block in every mode; [this guide sets up a delete guard for Claude Code](/learn/guides/stop-claude-code-deleting-files).

## What changes for you

**For Pro and Max subscribers:** the toggle flips automatically on August 14. The time to review your CLAUDE.md instructions and MCP server permissions is now — auto mode trusts them by default. Switch modes anytime with Shift+Tab in the CLI.

**For Enterprise admins:** auto mode remains opt-in temporarily. Anthropic plans to make it the default in the coming month. Early adopters at Adobe, Nuro, Gusto, and Garner Health already run auto mode as their production default. Across Teams & Enterprise adopters broadly, auto mode users shipped about 25% more PRs ([Anthropic](https://claude.com/blog/auto-mode-default-in-claude-code), 2026). Roll out incrementally using managed settings.

**For everyone watching the space:** Anthropic just shipped the first agentic coding default backed by independent safety data. Cursor, Copilot, and Codex will have to answer whether their agentic modes can match this bar — and whether they'll publish the data to prove it.

Canonical: https://neomanex.com/news/claude-code-auto-mode-default-aug-2026