Manual approval for AI shell commands feels responsible. The data Anthropic published in August 2026 says it often is not.
Starting August 14, 2026, new Claude Code sessions on Pro, Max, and Team default to auto mode: a classifier checks every tool call instead of you clicking Allow on 93% of prompts anyway. Anthropic also stopped charging classifier token overhead on those plans.
I ship agent harnesses for clients who ask whether "approve each command" is enough governance. This release is the clearest vendor answer yet: the human gate was already failing.
The numbers that flipped the default
Anthropic ran a controlled study with 1,053 paid professional testers. Mid-session, one permission prompt was swapped for a clearly dangerous command. Testers were not told what was being measured. Nothing dangerous actually executed.
| Reviewer | Dangerous commands caught |
|---|---|
| Human click-through | 13.6% (143 of 1,053) |
| Auto mode classifier | 89% (937 of 1,053) |
Head to head, auto mode blocked 800 commands humans approved. Humans blocked 6 the classifier allowed.
Approval fatigue showed up fast. Humans caught about 17% early in a session, then about 5% after 50 or more prior prompts. The classifier block rate stayed flat.
How the classifier actually works
Anthropic's engineering post frames three bad options before auto mode:
| Mode | Safety | Friction |
|---|---|---|
| Manual prompts | Medium (if you read every line) | High |
| Sandbox | High | High maintenance |
--dangerously-skip-permissions | None | Zero |
Auto mode sits between manual review and skip-permissions. A two-stage pipeline scores each tool call:
| Stage | Role | Trade-off |
|---|---|---|
| Stage 1 | Fast filter on most traffic | ~8.5% false positive rate on real traffic |
| Stage 2 | Deeper check on flagged calls | Full pipeline ~0.4% FPR, higher false negatives on edge cases |
When blocked, Claude tries a safer alternative or asks you. After three consecutive blocks or twenty total blocks in a session, Claude Code falls back to manual approvals so you are not stuck in a loop.
Toggle anytime with Shift+Tab. Pin defaultMode in settings if you want a permanent choice. Team admins can pin or disable auto mode org-wide.
What auto mode is not
Anthropic's own qualifier: classifiers do not eliminate risk. The engineering write-up is explicit that careful human review on high-stakes infrastructure can still beat a classifier that misses roughly 17% of "overeager" cases in one eval slice.
Auto mode targets developers who were already approving almost everything, or running --dangerously-skip-permissions because prompts became wallpaper. It is a harness upgrade, not a policy document.
For production deploy keys, database migrations on live data, or client environments under contract, I still want:
- Branch protections and human review on merges
- Scoped credentials (see AI agent secrets belong in a vault)
- Separate sessions for exploratory vs production work
Why the default change matters for long runs
Two product shifts landed together:
- Classifier tokens are free on Pro, Max, and Team (the overhead no longer counts against usage).
- Auto mode is default for new sessions unless you pinned another mode.
That combination pushes multi-hour and parallel agent work from "power user with skip-permissions" to "normal session on a paid plan." Pair it with parallel subagents or the new cross-session messaging path and you are looking at teams of agents that run while you are in meetings, not while you babysit Allow buttons.
Enterprise, API, Bedrock, Google Cloud Agent Platform, and Microsoft Foundry were not flipped on day one. Anthropic said it would roll default auto mode to those surfaces over the following month so admins could evaluate first.
What I changed in my own workflow
- Stopped treating Allow as security. If I cannot explain why a command is safe, auto mode blocking it is a feature.
- Pinned manual mode only on prod-adjacent repos where one bad
rmhas a phone number attached. - Log block events. When the classifier fires three times in a row, I read the session transcript before overriding. That pattern usually means the task spec is wrong, not that the harness is broken.
- Pair with git discipline. Auto mode does not replace commits, branches, or PR review. It reduces dumb shell mistakes mid-run.
The uncomfortable lesson
The permission prompt was never a firewall. It was a speed bump users learned to ignore.
Moving the safety load to a classifier that does not fatigue after 50 prompts is the right default for most coding-agent sessions. The work that still belongs to humans is defining what "dangerous" means in your environment, then wiring vaults, schedules, and review gates around that.
If you are rolling out Claude Code to a team and want help drawing the line between auto mode, sandboxes, and managed agents, book a free discovery call.