--- title: Auto Mode will soon be the default in Claude Code —... description: Anthropic is making auto mode the default in Claude Code starting August 14 for Pro, Max, and Team users. Research with 1,000+ testers showed humans approve... canonical: https://daily.dev/posts/auto-mode-will-soon-be-the-default-in-claude-code-because-humans-can-t-be-trusted-uxzbahrwk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Auto Mode will soon be the default in Claude Code — because humans can’t be trusted | daily.dev og:description: Anthropic is making auto mode the default in Claude Code starting August 14 for Pro, Max, and Team users. Research with 1,000+ testers showed humans approve... og:url: https://daily.dev/posts/auto-mode-will-soon-be-the-default-in-claude-code-because-humans-can-t-be-trusted-uxzbahrwk og:image: https://api.daily.dev/og/posts/uXZBAHrWk.png og:image:alt: Auto Mode will soon be the default in Claude Code — because humans can’t be trusted og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Auto Mode will soon be the default in Claude Code — because humans can’t be trusted **[The New Stack](https://daily.dev/sources/newstack)** · 5 min read · 0 upvotes · 0 comments ## Summary Anthropic is making auto mode the default in Claude Code starting August 14 for Pro, Max, and Team users. Research with 1,000+ testers showed humans approve 97% of permission prompts and only catch 13.6% of dangerous commands, while Claude Code in auto mode catches 89%. After 50 prompts, human detection drops to just 5%. Auto mode now includes hard denies for data exfiltration, explicit rules for secrets handling, git push destination checks, prompt injection screening, and a fallback to manual approvals after three consecutive blocks. Third-party testing by Trajectory Labs found zero of 720 prompt injection attacks got through with auto mode enabled, compared to 19% in OpenAI's Codex GPT-5.6 Sol in full access mode. Anthropic also announced parallel Claude Code sessions can now communicate with each other via summaries. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Claude Code auto mode compare to human review for catching dangerous commands? Claude Code in auto mode catches 89% of dangerous commands, while human testers only caught 13.6%. In a study with 1,000+ testers, humans approved 97% of all permission prompts. Performance degraded sharply over time — after 50 prompts, humans only detected 5% of dangerous commands. Auto mode blocks flagged commands rather than asking for approval, then looks for a safer alternative or escalates to the user. _Developers running long agentic sessions track safety tradeoffs like these on daily.dev._ ### How does Claude Code auto mode handle prompt injection attacks compared to OpenAI Codex? Third-party testing by Trajectory Labs found zero of 720 prompt injection attacks got through Claude Code in auto mode. Even with permissions fully bypassed, Claude Sonnet, Fable, and Opus 5 only let through 0.09% of attacks. By contrast, OpenAI's GPT-5.6 Sol in Codex let through 19% of attacks in full access mode and just under 6% in its auto-review mode. _Teams choosing between AI coding tools for security-sensitive work follow comparisons like this on daily.dev._ ### What are the hard deny rules in Claude Code auto mode and what triggers a fallback to manual approval? Claude Code auto mode's classifier is designed to never approve data exfiltration, such as sending code or secrets to an external destination. It also checks git push destinations to distinguish routine pushes from potential exfiltration, and screens web pages and tool outputs for prompt injection. Organizations can add custom hard deny rules. After three consecutive blocks, or twenty in a single session, auto mode reverts to manual approvals. _Engineers configuring AI agent permissions in production environments find relevant policy updates on daily.dev._ ## Similar posts on daily.dev - [Auto mode is now Claude Code's default, and it changes how fast you can actually build](https://daily.dev/posts/auto-mode-is-now-claude-code-s-default-and-it-changes-how-fast-you-can-actually-build-wpcvkw1sy) · XDA Developers · 0 upvotes · 0 comments - [Inside Claude Code Auto Mode: Anthropic’s Autonomous Coding System with Human Approval Gates](https://daily.dev/posts/inside-claude-code-auto-mode-anthropic-s-autonomous-coding-system-with-human-approval-gates-y2bcea0dg) · InfoQ · 1 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#anthropic](https://daily.dev/tags/anthropic), [#claude-code](https://daily.dev/tags/claude-code), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/auto-mode-will-soon-be-the-default-in-claude-code-because-humans-can-t-be-trusted-uxzbahrwk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Auto Mode will soon be the default in Claude Code — because humans can’t be trusted","url":"https://daily.dev/posts/auto-mode-will-soon-be-the-default-in-claude-code-because-humans-can-t-be-trusted-uxzbahrwk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/auto-mode-will-soon-be-the-default-in-claude-code-because-humans-can-t-be-trusted-uxzbahrwk"},"datePublished":"2026-08-07T21:48:08.231Z","dateModified":"2026-08-08T03:57:11.381Z","description":"Anthropic is making auto mode the default in Claude Code starting August 14 for Pro, Max, and Team users. Research with 1,000+ testers showed humans approve...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/363294fdba70cf1bc55de6f2001a08be?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/363294fdba70cf1bc55de6f2001a08be?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/auto-mode-will-soon-be-the-default-in-claude-code-because-humans-can-t-be-trusted-uxzbahrwk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,anthropic,claude-code,prompt-injection","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"Auto Mode will soon be the default in Claude Code — because humans can’t be trusted"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/auto-mode-will-soon-be-the-default-in-claude-code-because-humans-can-t-be-trusted-uxzbahrwk#faq","mainEntity":[{"@type":"Question","name":"How does Claude Code auto mode compare to human review for catching dangerous commands?","acceptedAnswer":{"@type":"Answer","text":"Claude Code in auto mode catches 89% of dangerous commands, while human testers only caught 13.6%. In a study with 1,000+ testers, humans approved 97% of all permission prompts. Performance degraded sharply over time — after 50 prompts, humans only detected 5% of dangerous commands. Auto mode blocks flagged commands rather than asking for approval, then looks for a safer alternative or escalates to the user. Developers running long agentic sessions track safety tradeoffs like these on daily.dev."}},{"@type":"Question","name":"How does Claude Code auto mode handle prompt injection attacks compared to OpenAI Codex?","acceptedAnswer":{"@type":"Answer","text":"Third-party testing by Trajectory Labs found zero of 720 prompt injection attacks got through Claude Code in auto mode. Even with permissions fully bypassed, Claude Sonnet, Fable, and Opus 5 only let through 0.09% of attacks. By contrast, OpenAI's GPT-5.6 Sol in Codex let through 19% of attacks in full access mode and just under 6% in its auto-review mode. Teams choosing between AI coding tools for security-sensitive work follow comparisons like this on daily.dev."}},{"@type":"Question","name":"What are the hard deny rules in Claude Code auto mode and what triggers a fallback to manual approval?","acceptedAnswer":{"@type":"Answer","text":"Claude Code auto mode's classifier is designed to never approve data exfiltration, such as sending code or secrets to an external destination. It also checks git push destinations to distinguish routine pushes from potential exfiltration, and screens web pages and tool outputs for prompt injection. Organizations can add custom hard deny rules. After three consecutive blocks, or twenty in a single session, auto mode reverts to manual approvals. Engineers configuring AI agent permissions in production environments find relevant policy updates on daily.dev."}}]} ```