Claude Code Turns Auto Mode On by Default Aug 14

Anthropic is flipping the default. Starting August 14, 2026, Claude Code will run in auto mode out of the box on Pro, Max and Team accounts, TechCrunch reported on Sunday. Instead of pausing for a human click at each step, the agent proceeds on its own — and stops only when an action looks irreversible, destructive, or aimed at something outside your environment.

The justification is a single pair of numbers from Anthropic's own trial, run across 1,053 paid users. Auto mode caught 89% of harmful actions. Manual review — a human reading each prompt and clicking approve or deny — caught 13.6%. That gap is not a claim about the model being smarter than you. It is a claim about what happens to a prompt you see a hundred times a day: Anthropic notes that users were already approving 97% of Claude Code's permission prompts, which makes the click a reflex rather than a review.

Anyone who has run an agentic coding session for more than an hour will recognise the pattern. The permission dialog is designed as a checkpoint, but its value decays with repetition, and a checkpoint that gets waved through 97 times in 100 is closer to a speed bump than a gate. Auto mode's bet is that a screening layer which never gets bored beats a human one that does.

What replaces the click is a set of guardrails rather than a single switch. Anthropic says auto mode ships with prompt-injection screening and customisable hard deny rules, so teams can put specific paths, commands or network destinations permanently out of reach regardless of what the agent decides it needs. Auto mode itself is not new — it arrived as a test option back in March 2026, and it is one of the five settings covered in our explainer on Claude Code's permission modes. What changes this week is which one you get if you never open the settings.

Internally the mode is already the norm. Boris Cherny, who heads Claude Code, wrote on X that "The team and I use Auto mode exclusively," and has done for months. That is a useful signal about ergonomics, and a limited one about risk: Anthropic's engineers are running the agent inside Anthropic's own environment, on Anthropic's own repositories, with the company's tooling around them.

The reason the guardrails matter more than the convenience is that the attack surface here is not hypothetical. In June, researchers showed how a planted bug report could hijack Claude Code through a connected tool — an injection that arrives as ordinary-looking data the agent is expected to read. Under ask-every-step, a suspicious command still had to survive one human glance. Under auto mode, prompt-injection screening is the glance. Anthropic is arguing, with data, that the screening is the better filter. It is also, from August 14, the only one most users will have switched on.

The practical move before next Friday is to decide what your hard deny list contains — production credentials, deploy commands, anything that reaches outside the repo — rather than discovering the new default mid-session.