Starting August 14, Claude Code activates Auto Mode by default on Pro, Max, and Team plans. The agent stops asking for confirmation at every step and only halts when an internal classifier evaluates the action as dangerous or irreversible. Enterprise customers still need to enable it manually.

Why this matters to you. The numbers defy intuition. In a controlled study with 1,053 testers, human reviewers caught 13.6% of dangerous commands. The Auto Mode classifier caught 89%. Teams with Auto Mode active produced roughly 25% more pull requests because the agent doesn’t stop waiting for a click.

An independent audit by Trajectory Labs tested 72 prompt injection scenarios, ten times each. Out of 720 attempts against Claude models in Auto Mode, zero passed. On GPT-5.6 Sol in Codex Auto-Review, 5.83% succeeded.

Anthropic still recommends manual review for production infrastructure changes. The classifier reduces risk, it doesn’t eliminate it.

This is the chapter with concrete numbers from an announcement we previewed in July. It closes a week of Claude Code releases (credential masking, session isolation, cross-session messaging, spend-limit) that moves the tool from versatile chat to production runtime. Governance shifts from manual to automatic.

In detail

Auto Mode has existed as an option for a while. The agent works independently and a classifier evaluates every action before executing it. If the action is safe and reversible, it proceeds. If it’s dangerous or irreversible, it asks for confirmation. Until now, the default was the manual approach: Claude Code stopped at every step and waited for your click.

The default shift starting August 14 rests on two pieces of evidence.

The first is internal. Anthropic conducted a controlled study with 1,053 paid testers plus internal red-teaming. Human reviewers approving manually caught 13.6% of dangerous commands. The Auto Mode classifier caught 89%. Teams with Auto Mode active generated roughly 25% more pull requests because the agent doesn’t stop waiting.

The second is external. Trajectory Labs, an independent security firm, tested 72 prompt injection scenarios, ten times each. Claude models (Fable 5, Opus 5, Sonnet 5) in Auto Mode blocked all 720 attempts. GPT-5.6 Sol in Codex Auto-Review let 5.83% of attacks through.

Two operational anecdotes from Anthropic: during a long session, Auto Mode stopped Claude from uploading confidential data to a public page. In another, it killed roughly 2,000 processes that would have interrupted ongoing GPU training jobs.

The paradox Anthropic acknowledges. The less often the developer intervenes, the more their oversight matters when they do. But building deep understanding of a project generated largely by Auto Mode without human involvement becomes harder. Anthropic states it explicitly: for production infrastructure changes, manual review remains the recommendation.

The limits. The numbers come from Anthropic’s tests, with sample and methodology chosen by the company selling the product. Trajectory Labs’ audit is independent but covers only prompt injection, not other vectors. Auto Mode isn’t available on Amazon Bedrock, Google Cloud Agent Platform, or Microsoft Foundry: those using those channels don’t benefit. The classifier consumes tokens, but Anthropic doesn’t bill for them.

What this means for builders. Effective governance doesn’t come from written rules the model can ignore (we measured this: frontier models follow policy documents less than four times out of ten). It comes from a classifier watching the action before it launches. This is the same principle as temporal policies and rate limits in AgentCore: an executable control, not a policy document.

If you want to give your agent tools and boundaries, the lesson from the course on tools and their limits is the starting point: decide what the agent can do, what it can’t, and how to intercept the boundary before it crosses it.