If you started a Claude Code session today in the terminal on a Pro, Max or Team plan, and neither you nor your admin had pinned a default, and you did not pass a --permission-mode flag at startup, and your admin had not disabled auto mode, and your account meets auto mode's requirements, it began in auto mode. Claude Code auto mode is the new default permission mode as of August 14, 2026, which means a classifier model reviews what Claude is about to do instead of you approving it prompt by prompt. Here is exactly what changed.
The scope is written into Anthropic's permission-modes documentation as a Note, and the exact wording is worth reading before anyone tells you what it says:
"Starting August 14, 2026, auto mode becomes the default permission mode for new sessions on Pro, Max, and Team plans. You can switch modes at any time. A default you set yourself stays in place unless you accept the one-time switch prompt, and a default your organization manages is unchanged."
New sessions. Three plan tiers. A default you set yourself survives unless you accept the one-time prompt. A default your admin set survives regardless.
What Claude Code auto mode actually does
The same docs page defines the mechanism in four sentences:
"Auto mode lets Claude execute without routine permission prompts. A separate classifier model reviews actions before they run, blocking anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read. Explicit ask rules still force a prompt."
Three things the classifier is watching for, then. Actions that go beyond what you asked for. Actions aimed at infrastructure it does not recognize. Actions that look like they came from something Claude read rather than from you, which is the prompt-injection case.
The docs give concrete examples of what it now decides rather than prompts about. Removals targeting the filesystem root or home directory, including rm -rf / and rm -rf ~, and including when the removal sits inside command or process substitution. Before v2.1.218 the plain forms prompted for approval, and the substitution forms prompted in v2.1.208 through v2.1.217. The classifier also reviews each message Claude sends to another agent with SendMessage before Claude Code delivers it, in auto mode and in plan mode while the classifier reviews commands, and that send review requires Claude Code v2.1.222 or later.
There is a circuit breaker. Per the docs, if the classifier blocks an action 3 times in a row or 20 times total, auto mode pauses and Claude Code resumes prompting; approving the prompted action resumes auto mode, and those thresholds are not configurable. Anthropic's announcement post describes the same rule in plainer language, saying that when the classifier blocks something Claude usually finds a safer way to proceed or asks directly, and if it cannot make progress after three blocks in a row or twenty across a session, "Claude Code falls back to manual approvals."
The docs also carry a warning, in its own callout:
"Auto mode reduces permission prompts but does not guarantee safety. Use it for tasks where you trust the general direction, not as a replacement for review on sensitive operations."
What changed on August 14, and who it reaches
Anthropic announced this a week ahead. The post "Auto mode is now the default in Claude Code for Pro, Max, and Team plans" carries a datePublished of Aug 07, 2026, and states the rollout plainly: "Starting on August 14, new sessions on Pro, Max, and Team plans will run in auto mode. If you've already set a different default yourself, you may get a one-time prompt asking whether you want to switch to auto mode. If you have a pinned default, nothing changes for you." The blog sentence omits the year that the docs Note states, so use the docs version if you need the precise date.
Everything outside those three plans stays where it was for now:
"Auto mode remains opt-in for now on Claude Enterprise, the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry, giving admins time to review the change. In the coming month, working with our cloud partners, we plan to make it the default across all of these and no longer charge for classifier overhead. In the meantime, Enterprise admins can make Claude Code's auto mode the default through managed settings."
Separately, the post ends the classifier surcharge for the three plans that flip today: "The auto mode classifier uses a small number of extra tokens per tool call, and we're no longer charging Claude Code users on Pro, Max, and Team plans for that classifier overhead, effective today." Here "today" is the post's own publication date, 7 August 2026, not August 14.
The coverage picked different angles on the same facts. InfoWorld led on permission fatigue, citing Anthropic's figure that 49.5% of active CLI users had created a Bash allow-rule by June and that 62% had used bypassPermissions or selected "don't ask again" for Bash, and balanced it with analysts warning that greater autonomy brings new oversight, latency and security risks. TechCrunch ran the drier framing that programming with Claude Code will soon require even less human oversight, and quoted Anthropic's own 97% approval line back at the safety comparison with an implied raised eyebrow. 9to5Mac treated it as a PSA and added the editorial view that this is probably the right default for experienced users, while users should establish some trust with coding agents before relying on auto mode.
The numbers, and how each one was measured
Anthropic's case rests on the claim that people had already stopped reading the prompts. Their own telemetry, in the announcement post: "manual review can become habitual: users approve 97% of permission prompts in Claude Code." The post admits most of those prompts are likely for safe, routine commands, and offers a contrast from the same data, that when Claude presents a plan for approval users reject 39% of them, while the rejection rate for individual permission requests is 3%.
The headline safety comparison comes from a designed experiment, and the design matters more than the result. Anthropic recruited 1,053 paid testers through a research vendor for a coding study. Those participants worked in a test environment set up specifically for the study, not in their own codebases or on real projects. They knew they were being evaluated but, following blind-study design, were not told which behavior was being measured. Partway through each session a single permission prompt was swapped for a clearly dangerous command, and the vendor recorded whether the tester approved it. Approving never ran anything dangerous; only the text of the prompt changed. On that setup: "The testers caught the dangerous command just 13.6% of the time (143 of 1,053), while auto mode blocked 89% of the same commands (937 of 1,053)."
Anthropic does not publish a miss rate for that experiment. Subtracting 89 from 100 gives 11%, which is arithmetic on their figure rather than a number they state, and it should not be read as auto mode's miss rate on real work.
Two more results from the same study are the ones worth remembering. Head to head, auto mode blocked 800 commands that a human approved, while humans blocked only 6 that auto mode allowed. And human attention decayed with session length: testers blocked about 17% of dangerous commands early in a session, dropping to about 5% after 50 or more prior prompts, while auto mode's block rate stayed flat regardless of session length.
One figure comes from real production sessions rather than the lab, and its denominator is narrow. Among sessions Anthropic's safety pipeline had flagged for review between May and June 2026, drawn only from accounts opted in to data use for training and analysis, 6.3% of the manually approved ones contained a harmful action the user had not explicitly asked for at production-level severity (7+), compared to 2.4% of auto mode sessions, with the gap holding at every severity level tested.
The adversarial number is separate and should never be merged with the 89%. Anthropic ran a two-week pilot with Apollo Research, a UK-based AI safety startup, injecting synthetic attacks into real coding trajectories across three datasets. After hardening the classifier, and after re-testing on a held-out attack set Anthropic never had access to, across both the shared and held-out sets "the classifier's miss rate fell from 12% to 7%." Anthropic flags the limit itself: "These attacks are synthetic and adversarial by design, built to find where the classifier fails, and more malicious than anything Claude would do unprompted. The 7% miss rate is measured against this set and should not be taken as the miss rate on real traffic."
The last adversarial number came from outside Anthropic, and its design is on the record too. Anthropic commissioned the evaluation from a third party, Trajectory Labs, which tested models inside the latest publicly available versions of Claude Code and Codex as of July 17, 2026, across 72 indirect prompt-injection scenarios "held out from Anthropic", each scenario run 10 times, for 720 attempts. On that set, "none of the 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode." Both products were tested through an identical browser integration Trajectory Labs built, and Anthropic bounds the result itself: safeguards built into first-party browser integrations were not tested, so "these results should be viewed as a measurement of the underlying model, rather than the complete set of safeguards which might exist in a given deployment."
The productivity figure is the softest of the set. Anthropic publishes no design for this one, which puts it below the controlled study on the evidence ladder: among Teams and Enterprise adopters, auto mode users ship about 25% more PRs, and Anthropic names Adobe, Nuro, Gusto and Garner Health as teams already running auto mode as their production default.
Claude Code permissions: how to keep or pin the mode you want
Switching is one keystroke. From the docs: "During a session: press Shift+Tab to cycle default → acceptEdits → plan. The status bar shows the active mode as ⏸ plan mode on, ⏵⏵ accept edits on, ⏵⏵ auto mode on, ⏵⏵ don't ask on, or ⏵⏵ bypass permissions on. Manual mode, default in that cycle, shows a gray ⏸ manual mode on badge."
Cycling into auto mode does not ask you to confirm, which is worth knowing if you share a screen or a keyboard.
To pin a mode instead of switching per session, set defaultMode inside the permissions object in a settings file such as ~/.claude/settings.json. There is one trap the docs call out by name, and it will look like the setting silently failed:
"If you set
defaultMode: "auto"in settings and the session starts indefaultmode with no error, the setting is likely in.claude/settings.jsonor.claude/settings.local.json. Claude Code v2.1.142 and later ignoreautofrom those files so a repository cannot grant itself auto mode. Move it to~/.claude/settings.json."
The same passage adds that in a session started by the VS Code extension, a settings-file defaultMode does not set the starting mode, and you pick the mode from the extension's mode indicator instead.
Administrators get a harder switch. Per the docs, they "can turn it off for the organization by setting permissions.disableAutoMode to "disable" in managed settings". The docs spell out the effect in their section on Bedrock, Google Cloud's Agent Platform and Microsoft Foundry: it "removes auto from the Shift+Tab cycle and rejects --permission-mode auto at startup".
Every Claude Code permission mode, and which one you are in
The docs describe six states and, more usefully, how each one becomes reachable:
- default, shown as the gray
⏸ manual mode onbadge. Reads run without asking; everything else prompts. This is what most people have been running. - acceptEdits, badge
⏵⏵ accept edits on. The second stop in the Shift+Tab cycle, and the mode people usually mean when they search for Claude Code auto accept. - plan, badge
⏸ plan mode on. Third in the cycle. - auto, badge
⏵⏵ auto mode on. It "appears when your account meets the auto mode requirements; cycling to it switches modes without a confirmation prompt". - bypassPermissions, badge
⏵⏵ bypass permissions on. It "appears after you start with--permission-mode bypassPermissions,--dangerously-skip-permissions,--allow-dangerously-skip-permissions, orpermissions.defaultMode: "bypassPermissions"in settings; the--allow-variant adds the mode to the cycle without activating it". - dontAsk, badge
⏵⏵ don't ask on. It "never appears in the cycle; set it with--permission-mode dontAsk".
Ordering matters if you have several enabled: "Enabled optional modes slot in after plan, with bypassPermissions first and auto last. If you have both enabled, you will cycle through bypassPermissions on the way to auto."
So the Claude Code dangerously skip permissions flag and auto mode are not two names for the same thing. One removes the check. The other replaces your review with a model's review and keeps explicit ask rules prompting. The Trajectory Labs evaluation Anthropic commissioned reports a 0.09% average attack success rate against Anthropic's latest models running in bypassPermissions mode without additional safeguards, against zero successes out of 720 attempts in auto mode.
Model and provider requirements apply too. Auto mode needs Claude Opus 4.6 or later, Sonnet 4.6 or later, or Fable 5 on the Anthropic API and Claude Platform on AWS; on Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry and signed-in Claude apps gateway sessions, only Claude Sonnet 5, Opus 4.7 or later, and Fable 5. Older models, including Sonnet 4.5, Opus 4.5, Haiku and claude-3 models, are not supported on any provider.
Is Claude Code safe to leave running like this?
Anthropic answers that question twice, in two documents, with two different sentences, and neither is a yes.
The docs warning says auto mode "reduces permission prompts but does not guarantee safety". The announcement post says that "while we believe auto mode reduces risk for most users, it relies on classification systems and therefore does not eliminate risk. For high-stakes changes to production infrastructure, we still recommend reviewing Claude's actions yourself."
Both are worth taking at face value. The 1,053-tester study says a classifier beats a distracted human at spotting one planted dangerous command in a lab. It does not say the classifier is a substitute for reading a diff before it touches production, and the Apollo Research result says a hardened classifier still missed 7% of a synthetic attack set built specifically to defeat it.
The practical read: auto mode is a better default than clicking Approve 97% of the time, and it is not a reason to stop reading what an agent did. The circuit breaker helps here. If a session starts feeling stuck, three blocks in a row or twenty across the session hands the prompts back to you, and that pause is a signal about the task rather than a bug to route around. One carve-out matters for the unattended case: the docs say a non-interactive -p run without a --permission-prompt-tool has no prompt to fall back to, so at the threshold the action simply does not run and Claude keeps working.
What it means when an agent runs unattended on your Mac
The default flipping matters most for the case where nobody is watching the terminal, which is exactly the case scheduled automations create.
We build Routines, a Mac app that runs AI routines on a schedule, and it can use your own Claude Code CLI as its execution engine. That choice is opt-in and off by default; the default engine setting is our own direct engine. When you do pick it, every flag we pass is built in one function in our source, build_args in llm/claude_code_runner.rs.
For a scheduled routine at commit 467cec8, those are the flags our arg builder emits:
claude --print --input-format stream-json --output-format stream-json --verbose \
--setting-sources "" --system-prompt-file <run>/system.md --model <model> \
--tools WebSearch,WebFetch --allowed-tools WebSearch,WebFetch,mcp__routines \
--strict-mcp-config --mcp-config <run>/mcp.json --max-turns 50 --no-session-persistence
Two disclosures belong in the same breath as that list, because a flag list is the kind of sentence that reads as a promise. First, the per-run MCP config also mounts every external MCP server you enabled, and our local bridge itself carries write-capable tools. Second, and this is the one people assume the other way around: WebSearch and WebFetch are pre-approved for unattended runs, so a scheduled routine can read pages on the open web without asking you first. The tool list is a hard-coded literal in our code rather than a setting, the same two builtins for every routine plus our own bridge, and the run is capped at 50 turns.
On permission modes specifically, our engine path passes no --permission-mode flag and no --dangerously-skip-permissions. There is one place we do pass it: a chat-only subagent tool that spawns Claude Code with --permission-mode bypassPermissions, which our bridge blocks from every scheduled-routine surface. On the engine path we hand the CLI our own system prompt file and --setting-sources "", an empty settings-source list, which Anthropic documents as the flag that controls which settings sources load. If you are wondering whether that also keeps a repo's CLAUDE.md out of the run, Anthropic documents --bare and --safe-mode, not --setting-sources, as the flags that skip CLAUDE.md, so anything beyond the settings files themselves is our inference rather than a receipt. What the CLI then does internally with these flags is Anthropic's behavior to document, not something our source can prove. The CLI is a third-party binary that ships new behavior on its own schedule, and this repo already carries one break of exactly that kind.
The bridge is a local HTTP MCP server on 127.0.0.1 with a bearer token generated once per app launch, and each run gets its own scope: a scheduled routine gets only the connectors that routine is bound to, and the bridge withholds the chat-only tools that create, edit or run routines, change app settings from the assistant, or start a Claude Code session. Computer control, if you turn it on for that routine, is a separate grant that reaches past that list. Sending is gated per routine, so with draft mode on, an action like sending an email is queued for your approval instead of running.
The honest counterweight sits in the same passage. Turn draft mode off and turn on computer control, and a routine can run shell commands on your Mac unattended. The command allowlist in Settings is empty by default, and an empty allowlist allows everything. That is a switch you can see and set, along with the engine picker, the computer-control switches, draft mode and the connector list on each routine, but nothing sets it for you.
If you want to watch an agent work with you rather than while you sleep, starting a Claude Code session from something you copied keeps you in the loop by construction. If you want the scheduled version, the Daily Overview routine is the one we run ourselves every morning, and the app is a free download for macOS.
Disclosure: the content on this site, this article included, is produced with Claude's help, and Claude Code is part of how we build and run the product described above. Every quotation here was pulled from Anthropic's own pages, and every claim about our own runner was read out of our source at commit 467cec8 rather than from memory.
FAQ
What is auto mode in Claude Code?
Anthropic's permission-modes documentation describes it this way: "Auto mode lets Claude execute without routine permission prompts. A separate classifier model reviews actions before they run, blocking anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read. Explicit ask rules still force a prompt." The docs add that if the classifier blocks an action 3 times in a row or 20 times total, auto mode pauses and Claude Code resumes prompting, and that those thresholds are not configurable.
Did auto mode become the default for everyone?
No. The docs Note is scoped: "Starting August 14, 2026, auto mode becomes the default permission mode for new sessions on Pro, Max, and Team plans. You can switch modes at any time. A default you set yourself stays in place unless you accept the one-time switch prompt, and a default your organization manages is unchanged." New sessions, not sessions already running. Anthropic's announcement post says auto mode "remains opt-in for now on Claude Enterprise, the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry, giving admins time to review the change", with a plan to make it the default across those "in the coming month".
Is Claude Code safe to run in auto mode?
Anthropic does not claim it is. The docs carry a warning: "Auto mode reduces permission prompts but does not guarantee safety. Use it for tasks where you trust the general direction, not as a replacement for review on sensitive operations." The announcement post says separately that auto mode "relies on classification systems and therefore does not eliminate risk", and recommends reviewing Claude's actions yourself for high-stakes changes to production infrastructure. Their published comparison is against human review rather than against perfection: in a controlled experiment with 1,053 paid professional testers working in a test environment built for the study, testers caught a planted dangerous command 13.6% of the time and auto mode blocked 89% of the same commands.
How do I turn off auto mode in Claude Code?
Press Shift+Tab during a session to cycle modes. The docs describe the cycle as default, then acceptEdits, then plan, with optional modes slotted in after plan. The status bar tells you where you are: "⏸ plan mode on", "⏵⏵ accept edits on", "⏵⏵ auto mode on", "⏵⏵ don't ask on", or "⏵⏵ bypass permissions on", and manual mode shows a gray "⏸ manual mode on" badge. Cycling into auto mode does not ask for confirmation.
How do I set a default permission mode in Claude Code settings?
Set defaultMode inside the permissions object in a settings file such as ~/.claude/settings.json. One catch is documented explicitly: "Claude Code v2.1.142 and later ignore auto from those files so a repository cannot grant itself auto mode", referring to .claude/settings.json and .claude/settings.local.json in a repo. If you set defaultMode to auto and your session still starts in default mode with no error, the setting is in the wrong file. In a session started by the VS Code extension, a settings-file defaultMode does not set the starting mode at all, and you select the mode from the extension's mode indicator instead.
What is the difference between auto mode and Claude Code auto accept?
They are separate modes. acceptEdits, the mode people usually mean by Claude Code auto accept, is the second stop in the Shift+Tab cycle and shows the "⏵⏵ accept edits on" badge. Auto mode is a different entry that appears in the cycle only when your account meets the auto mode requirements, shows "⏵⏵ auto mode on", and routes actions through the separate classifier model described in the docs. The docs list where enabled optional modes sit: after plan, with bypassPermissions first and auto last.
Is auto mode the same as Claude Code YOLO mode or dangerously skip permissions?
No. YOLO mode is the nickname for bypassPermissions, which the docs say appears in the cycle only after you start with --permission-mode bypassPermissions, --dangerously-skip-permissions, --allow-dangerously-skip-permissions, or permissions.defaultMode set to bypassPermissions in settings, and the --allow- variant adds the mode to the cycle without activating it. Auto mode keeps a classifier in front of every action and keeps explicit ask rules forcing prompts. In the Trajectory Labs evaluation Anthropic commissioned, none of the 720 attack attempts succeeded against Claude Fable 5, Opus 5 or Sonnet 5 running auto mode, while the same post reports a 0.09% average attack success rate against Anthropic's latest models running in bypassPermissions mode without additional safeguards.
Can my organization block auto mode?
Yes. The docs say administrators can turn it off for the organization "by setting permissions.disableAutoMode to "disable" in managed settings". The parallel statement for Bedrock, Google Cloud's Agent Platform and Microsoft Foundry spells out the effect: it "removes auto from the Shift+Tab cycle and rejects --permission-mode auto at startup". The docs Note also states that a default your organization manages is unchanged by the August 14 switch.
Does this change how Routines runs Claude Code on my Mac?
Routines can use your Claude Code CLI as its execution engine, and that choice is opt-in: the default engine setting is our own direct engine. On the engine path our arg builder passes no permission-mode flag, and it launches the CLI with our own system prompt file and --setting-sources "", an empty settings-source list, which Anthropic documents as the flag controlling which settings sources load. Hooks and plugins are configured through settings keys, so reading them as excluded is our inference, and Anthropic documents --bare and --safe-mode, not --setting-sources, as the flags that skip CLAUDE.md and plugin auto-discovery, so treat anything beyond the settings files themselves as our inference rather than a receipt. What the CLI does internally with those flags is Anthropic's behavior to document, not something our source can prove, so we describe what we pass and stop there. Worth knowing either way: WebSearch and WebFetch are pre-approved for unattended runs, so a scheduled routine can read pages on the open web without asking you first.
Sources
- Anthropic, "Permission modes", Claude Code documentation, accessed August 14, 2026
- Anthropic, "Auto mode is now the default in Claude Code for Pro, Max, and Team plans", published August 7, 2026
- Anirban Ghoshal, "Anthropic makes Claude Code's auto mode default for paid users", InfoWorld, August 11, 2026
- Anthony Ha, "Anthropic is turning Claude Code's auto mode on by default", TechCrunch, August 9, 2026
- Zac Hall, "PSA: Claude Code enabling auto mode as default next week, Anthropic says", 9to5Mac, August 7, 2026