Overview
Starting on August 14, new sessions on Pro, Max, and Team plans will run in auto mode. Instead of prompting for each action, auto mode routes every tool call through a classifier targeted at blocking actions that are irreversible, destructive, or aimed outside your environment.
Key features
-
Auto mode as the default on Pro, Max, and Team
Auto mode has been something users had to turn on themselves. From August 14, new sessions on these three plans run in auto mode. The announcement points to how little signal permission prompts were carrying: users approve 97% of permission prompts in Claude Code.
-
A classifier instead of prompts
Auto mode is designed to balance users’ desire not to be interrupted with a system that helps avoid harmful actions: instead of prompts, it routes each tool call through a classifier targeted at blocking actions that are irreversible, destructive, or aimed outside your environment. Data exfiltration, like sending your code or secrets somewhere external, sits in a category the classifier is designed to never approve.
-
What happens after a block
When the classifier blocks something, Claude usually finds a safer way to proceed on its own or asks you directly for the go-ahead. If it can’t make progress — three blocks in a row, or twenty across a session — Claude Code falls back to manual approvals.
-
Switching modes and admin controls
To switch modes, press Shift+Tab in the CLI or use the mode dropdown on the desktop app. Admins can pin an org-wide default with
defaultModein managed settings, or turn auto mode off entirely withdisableAutoMode. -
How permission rules interact
Permission rules still fire before the classifier in auto mode, except for allow rules broad enough to grant arbitrary code execution (e.g.
python:*). These arbitrary rules are set aside while in auto mode, since they would let commands skip the classifier entirely.
Notes
- Timing — the change applies to new sessions on Pro, Max, and Team plans starting August 14, 2026.
- Still opt-in elsewhere — auto mode remains opt-in for now on Claude Enterprise, the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud’s Agent Platform, and Microsoft Foundry. In the coming month, working with its cloud partners, Anthropic plans to make it the default across all of these.
- Risk is reduced, not removed — auto mode relies on classification systems and therefore does not eliminate risk. For high-stakes changes to production infrastructure, Anthropic still recommends reviewing Claude’s actions yourself.
- Measured results — human review caught just 13.6% of dangerous commands, while auto mode caught 89%.