SAN FRANCISCO, 10 AUG 2026 — On Friday the approval prompt in Claude Code will disappear for most paying users. Anthropic justifies it by citing a study in which people caught 13.6% of dangerous commands.
Auto mode has existed since March. From 14 August it becomes the default for Pro, Max and Team accounts, which means the coding agent will run tool calls without asking, except where a classifier judges an action irreversible, destructive, or aimed outside the environment it was given. Anthropic announced the change on 7 August.
What actually changes
Today each tool call can raise a prompt: run this command, edit this file, install this package. From Friday a classifier makes that decision instead. If it blocks something, the agent can look for a safer route or escalate to a human; after repeated blocks the session falls back to asking, as it does now.
The change comes with two additions. First, the classifier screens for prompt injection, which matters when an agent reads attacker-controllable text from a web page or an issue tracker. And administrators can write hard deny rules — a list of things that are never permitted regardless of what the classifier concludes.
If you have pinned a different default, or your organisation manages the setting, nothing moves. If you have never touched it, you will get an in-app notice and your next session starts in auto mode. Anthropic has also stopped charging for the extra tokens the classifier consumes on each call.
The number, and where it came from
Anthropic tested with 1,053 paid users. In that study people identified 13.6% of harmful actions. Auto mode identified 89%. Human performance fell further with time on task: after roughly 50 prompts it was down to about 5%.
The company's explanation is habituation, and it offers a second figure for it — across those sessions, users approved 97% of the prompts they were shown. A control that is approved 97 times in 100 is not being read. It is being cleared.
We measured the same thing on Sunday, and got a different answer
On 9 August we reported an independent measurement of the same control: a browser game by the developer Alex Wauters that logged 409,000 approve-or-deny decisions. Its players missed 33.7% of malicious commands, blocked more than half of some perfectly safe ones, and got worse as a session went on.
Both findings point the same way. They disagree by a factor of five about how far.
The gap has explanations that pull in opposite directions. Wauters's players were self-selected, had no repository context and nothing at stake, which should make them worse than a professional in a real session, not better — except that a game keeps you alert in a way the four-hundredth prompt of a working afternoon does not. Anthropic's testers were in real sessions, where habituation is real, which arguably makes 13.6% the more honest number for how this control performs in the wild.
Note that the party proposing to remove the human is the one reporting the low human score, from a study nobody outside the company has audited. That is not an accusation. It is a reason the independent number matters, and a reason someone should run the controlled trial neither of these is.
What 89% leaves behind
The headline comparison is 89 against 13.6. The number to sit with is the other one: 11% of harmful actions got through the classifier.
Under the old default those 11% still had a human in front of them, and by Anthropic's own figures that human caught about one in seven. Under the new default they have nobody. The change is not from bad review to good review; it is from two weak filters in series to one strong filter alone, and the arithmetic of that depends entirely on whether the two were failing on the same things. Nobody has published that.
Anthropic is not overselling this. Its own material says classifiers cannot eliminate risk and recommends human review for production changes. That is the right caveat, and it sits awkwardly next to a default that removes human review for everyone who has not opted out.
Where this is an improvement
Prompt-injection screening on every tool call is a clear improvement, not a substitute. The old permission prompt could not detect injection; a human has no way to know a plausible-looking command came from a comment in a file the agent read ten minutes ago.
Hard deny rules are the other useful addition. They give security teams something concrete to reason about: a fixed list, with no model and no drift involved in the decision. If you administer this in an organisation, that list is where your effort belongs this week — not in deciding whether to trust the classifier, but in writing down what must never happen regardless of it.
What to do before Friday
Decide deliberately rather than accepting the default. Doing nothing is a choice, and it is the one Anthropic has made for you.
If you keep auto mode, write the deny rules first, and check what your agent's environment can actually reach: credentials in the shell, a cloud CLI already authenticated, a production database in a config file. The classifier decides what is "aimed outside your environment" on the basis of an environment you defined, possibly by accident.
If you turn it off, be honest about what you are keeping. On these numbers the prompt is not a safeguard; it is a record that you were present. That has value for audit and almost none for prevention.
What to watch
Whether the study is published in enough detail to check — the sample, the command mix, how "harmful" was defined, and whether the 11% the classifier missed overlaps the 86% the humans missed.
Whether other agent vendors follow. Cursor, OpenAI's Codex and the rest ship the same control with the same fatigue problem, and one company has now put a number on it and acted.
And whether anyone measures this outside a vendor or a game. We have two studies agreeing that the human in the loop does not work, but neither was designed to measure how badly.
View author profile → · Editorial policy
