Auto mode is now the default in Claude Code

TL;DR Highlight

Claude Code makes auto mode default Aug 14; it blocked 89% of dangerous commands vs humans' 13.6%

Who Should Read

Developers tired of Claude Code permission prompts who use bypass mode or must pick a team default

Core Mechanics

Auto mode becomes default Aug 14
- New sessions on Pro, Max, and Team plans start in auto mode.
- Users who pinned their own default see no change.
- Enterprise, API, Bedrock and others stay opt-in for now, with a default switch planned within a month.
A classifier gates each tool call
- Every tool call goes through a classifier, a model that judges whether a command is risky.
- It targets irreversible, destructive, or out-of-environment actions.
- After 3 blocks in a row or 20 in a session, it falls back to manual approval.
Human approval turns into habit
- 97% of permission prompts get approved.
- Users reject 39% of plans but only 3% of individual permission requests.
- 49.5% of active CLI users created a Bash allow-rule themselves.
Dangerous commands caught: humans 13.6% vs auto 89%
- In a study of 1,053 paid testers, humans blocked 143 and auto mode blocked 937.

Community Reactions

Opinion from a year-long bypass user
- One commenter said safety is the developer's job via guardrails like VCS and read-only tokens.
- They argued that using Claude to police Claude is not the answer.
Concern that the classifier is the same model
- One commenter said Claude tries non-dangerous but misaligned actions, like micromanaging sub-agents, which they want to block manually.
- They said the classifier approves those because it is also Claude.
Mixed hands-on experience
- One user ran their own Haiku classification script before switching to the built-in classifier, with rare false blocks.
- Another said Claude found an old admin AWS profile and tried to use it.
- Another said a classifier change suddenly broke their Opus 4.6 security work.
Advice to pair it with sandboxes
- One user combines Anthropic's srt with auto mode.
- Many commenters run agents in Docker containers.
- One argued agents should run in full sandboxes, not on the host.

How to Apply

Check your default mode in settings today
- Open Claude Code settings and see whether defaultMode is auto or a pinned value.
- Decide before Aug 14 whether to use auto or manual.
Audit broad allow-rules
- Search settings for rules like Bash(python:*) and Bash(node:*).
- Auto mode ignores them, so keep only the narrow rules you need.
Pair auto mode with a sandbox
- On a small project, enable sandbox plus defaultMode auto and test write and read access yourself.
- Block secret and credential paths with denyRead.
On Enterprise, set a team default via managed settings
- Admins can set auto mode as default through managed settings.
- Add commands that must never run to the hard deny rules.

Try It

copy & run

# Merge into Claude Code settings.json (example based on a commenter's config)

{
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "autoAllowBashIfSandboxed": true,
    "allowUnsandboxedCommands": false,
    "filesystem": {
      "allowWrite": ["."],
      "denyRead": ["~/*"],
      "allowRead": ["."]
    }
  },
  "defaultMode": "auto"
}

# Try next: ask it to read a path outside the sandbox and confirm it is blocked.

Terminology

auto modeA Claude Code permission mode where a classifier judges each tool call. Instead of asking every time, a guard filters only the risky ones.

classifierA model that judges whether a command is safe or risky. It works like airport security screening every call.

bypassPermissionsA mode that skips all permission checks. It's like working with every lock removed.

prompt injectionAn attack hiding instructions in web pages or files to steer an agent. It's like a fake work order slipped into a parcel.

hard denyA category the classifier never approves, such as sending code or secrets outside.