Key Takeaways

• Starting August 14, 2026, new Claude Code sessions on Pro, Max, and Team plans default to auto mode — per-action approval prompts replaced by a Sonnet 4.6 transcript classifier
• Users who already have any mode pinned are unaffected; only users with no pinned preference receive a one-time opt-out prompt before the August 14 default takes effect
• Anthropic’s own engineering post reports 93% of manual prompts are accepted anyway; a 1,053-tester controlled study found the classifier outperformed fatigued human reviewers — but all datasets are Anthropic-commissioned
• Before August 14, Team administrators should configure org-level hard deny rules for production systems, regulated data, and external write endpoints — hard denies run before the classifier and cannot be overridden by it

Starting August 14, new Claude Code sessions on Pro, Max, and Team plans will stop presenting per-action approval prompts. A transcript classifier — running on Claude Sonnet 4.6 — evaluates each tool call before execution and blocks those it judges to be irreversible, destructive, or outside the working environment. Anthropic’s engineering post frames the rationale plainly: users accept 93% of manual prompts anyway, so the prompts were generating fatigue rather than oversight.

What Actually Changes on August 14?

Per Anthropic’s announcement, users who already have a mode pinned — auto or otherwise — are unaffected. Only accounts with no pinned preference switch over; those users receive a one-time opt-out prompt before August 14 applies to their sessions.

Auto mode is explicitly not bypassPermissions. Anthropic’s permission-mode docs draw a clear line: bypassPermissions removes all safety gates; auto mode delegates approval decisions to a classifier while keeping hard deny rules in force. In-project file edits pass without classifier overhead because version control makes them reversible. Shell commands, web requests, and out-of-project writes all route through the classifier. After three consecutive denials — or 20 total in a session — Claude Code reverts to manual approval.

Alongside the default change, Anthropic added a prompt-injection probe that screens tool outputs (file reads, shell results, web fetches) before they enter Claude’s context, plus default deny rules covering data exfiltration paths, destructive Git operations, and sensitive data access. For Team administrators, these defaults are the floor — not the ceiling. Hard deny rules customized to your environment run before the classifier and cannot be overridden by it.

Is Auto Mode Safe Enough for Production?

Anthropic’s engineering post reports classifier performance across three internal datasets: 17% false-negative rate on 52 real overeager actions (roughly one dangerous command in six slipped through); 5.7% false-negative rate on 1,000 synthetic data-exfiltration attempts; and 0.4% false-positive rate on 10,000 real tool calls from Anthropic employees.

Three caveats apply before treating these numbers as production benchmarks: all datasets were created and evaluated by Anthropic; the real overeager set is only 52 samples; and no independent evaluation of the classifier has been published. Anthropic is direct about the limitation: “It is not a drop-in replacement for careful human review on high-stakes infrastructure.”

For teams in regulated or security-sensitive environments, the August 14 deadline is a governance checkpoint. The classifier with well-configured hard deny rules is more controllable than documented baseline behavior — where 93% of prompts were approved by reflex. But the rules need to exist before the default switches.

Watch for: independent evaluation of the classifier; Anthropic’s post-rollout telemetry on real-world miss rates; and whether Enterprise admin controls are documented before or after August 14. Enterprise plan behavior has not been confirmed publicly — Enterprise administrators should verify the August 14 scope directly with Anthropic.

---

FAQ

Does auto mode mean Claude Code can act without human approval?

No. Auto mode replaces repetitive per-action prompts with a classifier, not with unchecked autonomy. Hard deny rules your team configures run before the classifier and cannot be overridden by it. After three consecutive classifier blocks — or 20 total in a session — Claude Code escalates back to manual approval. For multi-agent Claude Code workflows, the same classifier runs at both ends of each subagent handoff. See Anthropic’s permission-mode docs for the complete mode comparison including bypassPermissions.

What should teams using Claude Code in regulated environments do before August 14?

Verify your current mode setting: run claude config list in the CLI or check the mode selector in your IDE. If your team’s Claude Code deployment can reach production systems, regulated data paths, or external write endpoints, configure hard deny rules for those boundaries before August 14 — the classifier is a supplement to deny rules, not a replacement. For teams evaluating Claude Code alongside GitHub Copilot, the auto-mode architecture and classifier safety model are now concrete differentiation points worth comparing. Enterprise administrators should confirm with Anthropic whether the August 14 default change applies to their plan.