--- title: Auto mode is now the default in Claude Code | daily.dev description: Anthropic is making auto mode the default in Claude Code for Pro, Max, and Team plans starting August 14. Auto mode routes each tool call through a safety... canonical: https://daily.dev/posts/auto-mode-is-now-the-default-in-claude-code-n2re90yec twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Auto mode is now the default in Claude Code | daily.dev og:description: Anthropic is making auto mode the default in Claude Code for Pro, Max, and Team plans starting August 14. Auto mode routes each tool call through a safety... og:url: https://daily.dev/posts/auto-mode-is-now-the-default-in-claude-code-n2re90yec og:image: https://api.daily.dev/og/posts/n2rE90yEc.png og:image:alt: Auto mode is now the default in Claude Code og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Auto mode is now the default in Claude Code **[Hacker News](https://daily.dev/sources/hn)** · 16 min read · 0 upvotes · 0 comments ## Summary Anthropic is making auto mode the default in Claude Code for Pro, Max, and Team plans starting August 14. Auto mode routes each tool call through a safety classifier that blocks irreversible, destructive, or out-of-environment actions, rather than relying on manual permission prompts. Testing showed users only caught dangerous commands 13.6% of the time versus auto mode's 89% block rate. Among Teams and Enterprise users, auto mode users ship about 25% more PRs. The classifier overhead tokens are no longer charged to Pro, Max, and Team users. Enterprise and API users remain opt-in for now, with a rollout planned within the coming month. New safety features include hard denies for data exfiltration, git-status checks before destructive operations, and prompt injection screening. Companies like Adobe, Nuro, Gusto, and Garner Health already run auto mode as their production default. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When does Claude Code switch to auto mode by default for Pro, Max, and Team plans? Starting August 14, new Claude Code sessions on Pro, Max, and Team plans run in auto mode by default instead of prompting for manual permission approval on each action. Users who already set a different default may get a one-time prompt asking whether to switch, and those with a pinned default via managed settings see no change. Enterprise, API, and cloud-partner deployments remain opt-in for now but are expected to switch within a month. _Teams weighing this permission change can track how it plays out for real Claude Code users on daily.dev._ ### How does Claude Code's auto mode compare to manual permission approval for catching dangerous commands? In a controlled study with 1,053 paid testers, human testers clicking through permission prompts caught a dangerous command only 13.6% of the time (143 of 1,053), while auto mode's classifier blocked 89% of the same commands (937 of 1,053). Auto mode blocked 800 commands that a human tester approved, while humans blocked only 6 that auto mode allowed, and human detection dropped further as sessions grew longer. _Developers deciding whether to trust agent autopilot over manual review can follow this safety debate on daily.dev._ ### How resistant is Claude Code's auto mode to prompt injection attacks compared to Codex? In an evaluation of 72 indirect prompt injection scenarios tested 10 times each (720 attempts total) by Trajectory Labs, none succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running Claude Code's auto mode, while 5.83% succeeded against GPT-5.6 Sol running Codex's Auto-review mode and 19.03% succeeded in Codex's Full Access mode. The tests used Claude Code v2.1.205 and Codex v0.144.5. _Anyone comparing agentic coding tools on security posture can keep up with these benchmarks via daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 114 comments across hackernews (as of 2026-09-14). **TL;DR:** The community is broadly skeptical of auto mode as a default, preferring sandboxing (Docker, VMs, devcontainers) over classifier-based safety, though many acknowledge the permission-fatigue problem is real and that manual review is largely theater anyway. **Sentiment:** 25% positive · 45% mixed · 30% skeptical **The case for** - Auto mode solves genuine permission fatigue — users approve 97% of prompts anyway, often without reading them, so the classifier likely catches more than humans do. - Making classifier tokens free removes a meaningful cost concern for teams already using auto mode. - The 89% block rate vs. 13.6% human catch rate is a compelling empirical argument for the classifier's effectiveness. - Auto mode is a sensible default for less technical users who can't evaluate complex bash pipelines. **The pushback** - Many experienced developers prefer sandboxing (Docker, VMs, devcontainers) as a more principled safety boundary than an LLM-based classifier. - The classifier can produce false positives that interrupt legitimate workflows, and server-side changes to it can silently break established pipelines. - Using another aligned model to judge the safety of the primary model's actions may inherit the same failure modes. - Auto mode doesn't address the root cause: the tool generates unnecessarily complex, hard-to-review bash commands instead of using simpler built-in tools, which is what creates fatigue in the first place. - Opaque, server-side classifier changes create fragility for teams building long-running automated processes. **By community** - hackernews (mixed): Developers are split — many run yolo/dangerously-skip-permissions in sandboxes and see classifier-based safety as the wrong layer, while others accept auto mode as a pragmatic default given how poorly manual review actually works in practice. **Hottest debate:** Whether an LLM-based safety classifier is a meaningful security boundary at all, versus proper OS-level sandboxing being the only trustworthy solution. **Open questions** - Will manual mode settings continue to be respected in future updates, or will auto mode eventually become mandatory? - How does the classifier handle prompt injection attacks that try to disguise dangerous commands as safe ones? - Can users configure hard denylists (e.g., never allow git stash drop, never allow rm -rf) within auto mode? - What recourse do users have when opaque server-side classifier updates silently break their production pipelines? **Highlights** > I'm apparently from the very small faction of users who's been running `--dangerously-skip-permissions` in every instance of Claude for the last year. It's almost a reflex to me. For the most part Claude behaves well, but I don't blindly trust it. LLMs are inherently dangerous tools, and reviewing individual commands (or spamming `y`) doesn't make them less so. Safety is the responsibility of the developer putting sane guardrails (like VCS, immutable filesystems, or read-only tokens). Using more Claude to categorize the safety of Claude commands is not the answer. > — [awkii on hackernews · 6 comments](https://news.ycombinator.com/item?id=49239648) > > Data suggests that manual review can become habitual: users approve 97% of permission prompts in Claude Code. Claude's 'auto mode' feels like a solution to a problem that shouldn't exist. Cursor handles this much better IMO. When the agent wants to run a command, Cursor lets you choose between 'allow once' and 'add command to allowlist'. The latter lets the agent run that command (grep, ls, pwd etc) any number of times for that project, which means you get a lot of these manual reviews when you start a new project but rarely (if ever) thereafter. > — [nomilk on hackernews · 2 comments](https://news.ycombinator.com/item?id=49239808) > Am I the only person reading the statistics in this announcement from Anthropic and the associated blog commentary and trying to work out how they possibly couldn't imply that a significant number of dangerous commands are likely to be attempted every day these tools are in use and neither manual human review nor the auto classifier provided by Claude is anywhere near reliable in preventing them? A lot of the discussion about these long sessions where agents are left to operate autonomously feels like listening to the increasingly drunk guy at the bar who says "I ran IT at that Fortune 100 place for a decade and we never had a single problem using a short but loose rule set for the firewall until last week someone destroyed our entire business in 27 minutes". > — [Silhouette on hackernews](https://news.ycombinator.com/item?id=49239558) > It's great that they're making the auto usage tokens free by default and I guess auto mode will be a good default for a lot of workloads, but recent changes to the auto mode classifier just moved me to either use YOLO mode or use a different harness. I've been using Opus 4.6 for some security related work (it has much looser guardails that later opus models) and last week, all of a sudden, the processes started to fail. It wasn't the main model blocking commands but the auto mode classifier changed how it worked and it started blocking the main models commands. That's one specific incident, but it does have a wider potential problem which is, if you use Anthropic's harness you'll always be at the risk of sudden breakage from server-side changes that are opaque to the end user, which is a tricky one for building long lasting processes. > — [raesene9 on hackernews](https://news.ycombinator.com/item?id=49239977) > Their findings about auto mode catching more dangerous commands, and most permission requests being accepted without scrutiny is interesting. I can totally see how that happens. On the other hand, soooo many of the tool uses it asks permission for are custom commands to replace functionality I should be able to trust once instead. e.g. instead of having a trustable Find tool, or using its already-trusted Read tool, it often will run `find` or `grep` or `cat` with a series of pipes and substitutions or `-exec` args, requiring me to give permission every time for basic, safe operations. The (increasingly active) conspiracy theorist inside of me says it's precisely designed to do that, to give me "permission fatigue", so I turn on auto mode and give myself over to the machine spirit :) > — [frogulis on hackernews · 3 comments](https://news.ycombinator.com/item?id=49239523) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49239021) · 130 points · 114 comments ## Similar posts on daily.dev - [Auto mode is now Claude Code's default, and it changes how fast you can actually build](https://daily.dev/posts/auto-mode-is-now-claude-code-s-default-and-it-changes-how-fast-you-can-actually-build-wpcvkw1sy) · XDA Developers · 0 upvotes · 0 comments - [Inside Claude Code Auto Mode: Anthropic’s Autonomous Coding System with Human Approval Gates](https://daily.dev/posts/inside-claude-code-auto-mode-anthropic-s-autonomous-coding-system-with-human-approval-gates-y2bcea0dg) · InfoQ · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#claude-code](https://daily.dev/tags/claude-code), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/auto-mode-is-now-the-default-in-claude-code-n2re90yec) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Auto mode is now the default in Claude Code","url":"https://daily.dev/posts/auto-mode-is-now-the-default-in-claude-code-n2re90yec","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/auto-mode-is-now-the-default-in-claude-code-n2re90yec"},"datePublished":"2026-08-10T05:06:01.683Z","dateModified":"2026-09-14T08:05:48.249Z","description":"Anthropic is making auto mode the default in Claude Code for Pro, Max, and Team plans starting August 14. Auto mode routes each tool call through a safety...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0422e7491790e0e04228f6f54fd089d9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0422e7491790e0e04228f6f54fd089d9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/auto-mode-is-now-the-default-in-claude-code-n2re90yec","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,claude-code,prompt-injection","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Auto mode is now the default in Claude Code"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/auto-mode-is-now-the-default-in-claude-code-n2re90yec#faq","mainEntity":[{"@type":"Question","name":"When does Claude Code switch to auto mode by default for Pro, Max, and Team plans?","acceptedAnswer":{"@type":"Answer","text":"Starting August 14, new Claude Code sessions on Pro, Max, and Team plans run in auto mode by default instead of prompting for manual permission approval on each action. Users who already set a different default may get a one-time prompt asking whether to switch, and those with a pinned default via managed settings see no change. Enterprise, API, and cloud-partner deployments remain opt-in for now but are expected to switch within a month. Teams weighing this permission change can track how it plays out for real Claude Code users on daily.dev."}},{"@type":"Question","name":"How does Claude Code's auto mode compare to manual permission approval for catching dangerous commands?","acceptedAnswer":{"@type":"Answer","text":"In a controlled study with 1,053 paid testers, human testers clicking through permission prompts caught a dangerous command only 13.6% of the time (143 of 1,053), while auto mode's classifier blocked 89% of the same commands (937 of 1,053). Auto mode blocked 800 commands that a human tester approved, while humans blocked only 6 that auto mode allowed, and human detection dropped further as sessions grew longer. Developers deciding whether to trust agent autopilot over manual review can follow this safety debate on daily.dev."}},{"@type":"Question","name":"How resistant is Claude Code's auto mode to prompt injection attacks compared to Codex?","acceptedAnswer":{"@type":"Answer","text":"In an evaluation of 72 indirect prompt injection scenarios tested 10 times each (720 attempts total) by Trajectory Labs, none succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running Claude Code's auto mode, while 5.83% succeeded against GPT-5.6 Sol running Codex's Auto-review mode and 19.03% succeeded in Codex's Full Access mode. The tests used Claude Code v2.1.205 and Codex v0.144.5. Anyone comparing agentic coding tools on security posture can keep up with these benchmarks via daily.dev."}}]} ```