Anthropic said on 7 August that from 14 August, new Claude Code sessions on Pro, Max and Team plans will run in auto mode. Instead of approving each command, every action routes through a classifier built to block anything irreversible, destructive or aimed outside the user's environment.
The number that justifies it
Anthropic hired 1,053 paid testers through a research vendor for a coding study, embedding one dangerous command in a permission prompt for each. The testers caught it 143 times — 13.6%. Auto mode blocked the same command 937 times — 89%. Both figures describe the same controlled set, which is what makes the comparison mean anything.
Attention decays; the classifier does not
The more interesting finding is the curve. Humans blocked about 17% of dangerous commands early in a session, falling to roughly 5% after 50 or more prior prompts. Auto mode's block rate stayed flat regardless of session length. Testers approved 97% of permission prompts while rejecting 39% of plan approvals — they were reading plans and rubber-stamping commands.
Two studies, not one
A separate third-party evaluation by Trajectory Labs ran 72 indirect prompt-injection scenarios ten times each — 720 attempts — against Claude Fable 5, Opus 5 and Sonnet 5 in auto mode, on versions current at 17 July. None succeeded, and it covered Codex as well. Folding those 720 into the tester study, as several write-ups do, merges two different experiments.
What actually changes
Auto mode already existed. What changes is the default, and with it the argument: unintended harm appeared in 6.3% of manually approved sessions against 2.4% under auto mode, and auto-mode users at Team and Enterprise customers ship about 25% more pull requests.