Claude Code Auto Mode: What the New Default Actually Does

§ 01What changed on August 14

The mechanics of the rollout were narrower than the headlines suggested. New sessions on Pro, Max, and Team plans start in auto mode if you had not configured a default permission mode. If you had selected another default without pinning it, Claude Code could show a one-time offer to switch. Pinned defaults were left alone, and existing or resumed sessions generally kept their current mode.

The built-in default also depends on the client: v2.1.228 or newer on macOS, Linux, and WSL, and v2.1.233 or newer on native Windows. Older versions keep manual as their built-in default. Enterprise plans were not flipped: auto mode remained opt-in there at announcement time, with admins able to set an organization-wide default through managed settings.

§ 02What auto mode is, and is not

The most common misreading of this change is that Claude Code now auto-approves everything. It does not. Auto mode is a middle tier between manual prompting and the genuinely unguarded bypassPermissions mode.

Under auto mode, operations sort into three tiers. Intrinsically safe operations execute directly. File reads, writes, and edits inside the project also generally execute without review, on the logic that version control makes them recoverable. Everything with a larger blast radius goes through a transcript classifier: shell commands, web fetches, external integrations and MCP tools, subagent spawning, and filesystem operations outside the project.

The classifier is a two-stage system. A fast, deliberately cautious filter makes a first pass; anything it flags goes to a second reasoning stage meant to cut false positives. It evaluates whether an action escalates beyond what you asked for, touches unrecognized infrastructure, could be irreversible, could exfiltrate data, or looks influenced by hostile content. Tool results are also screened for prompt-injection payloads before Claude sees them.

Your explicit rules still outrank all of it. A permissions.ask rule (say, on git push) always prompts. A permissions.deny rule blocks the action before the classifier is consulted. Hard-deny categories such as data exfiltration cannot be approved by the classifier at all. And the system has a humility valve: after three consecutive blocks, or twenty in one session, auto mode pauses and hands control back to manual prompting.

§ 03The numbers Anthropic published

The interesting part of the announcement is the argument for why default-on autonomy is safer, not riskier. In Anthropic’s testing, human reviewers caught 13.6% of deliberately inserted dangerous commands. The classifier caught 89% of the same set. Reviewers got measurably less attentive as prompt volume grew, and in reviewed production sessions, serious unintended harm showed up more than twice as often after a human clicked approve as it did in auto mode sessions. Approval fatigue is not a theory; it is the measured failure mode of asking humans to review everything.

Anthropic is also candid about the gate’s limits: a 17% false-negative rate on a small set of real overeager actions, where Claude was pursuing the user’s goal but attempted something beyond clear authorization. A red-team exercise cut the adversarial miss rate from 12% to 7%. The company’s own recommendation is direct human review for high-stakes production infrastructure changes. The honest summary: the classifier is better than a tired human, and it is not perfect.

§ 04How to tune or disable it

For the current session, Shift+Tab switches from auto to manual. For a persistent choice, set a default in ~/.claude/settings.json:

json { "permissions": { "defaultMode": "default" } }

To remove auto mode entirely, including from the Shift+Tab cycle:

json { "permissions": { "disableAutoMode": "disable" } }

Two tuning options are worth knowing even if you keep auto mode on. permissions.ask rules put explicit human checkpoints on the actions you care about (pushes, PR creation, deploys), and they survive context compaction, which conversational instructions like “don’t push yet” may not. And autoMode.classifyAllShell set to true routes every shell command through the classifier, closing the gap where a narrow pre-existing allow rule could approve a command before review.

§ 05The same pattern, applied to a whole business

A coding session is the narrow case of this problem. The wide case is an AI worker that does not just edit a repo but sends email, updates a CRM, posts to a browser session, and runs terminal jobs, unattended, on a schedule. The review-everything model collapses even faster there, because nobody is sitting at the desk when the prompt appears.

That is the case CellCog built for. Every command that reaches your world - terminal commands on your machine, actions in your real browser, or any of 1,000+ connected tools - passes through one approval rail: the agent classifies every command before it executes, and the platform rejects any command that arrives unclassified. The owner sets each employee’s auto-approve threshold: everything at or below it runs autonomously, everything above it waits for review or for a standing approval the owner granted in advance. Nothing above the threshold executes silently. You can also control exactly which tools and credentials each employee can use - anything you don’t grant never enters that employee’s environment, enforced on the server, not just hidden in the UI. The practical effect is the same one Anthropic measured: the human reviews a handful of genuinely consequential actions instead of rubber-stamping hundreds of routine ones. The design is covered in depth in one approval rail for every tool and AI employee permissions and approvals.

§ 06The honest caveats

The classifier is probabilistic, and Anthropic says so: 17% of overeager actions slipped through in its own evaluation, and the company recommends human review for high-stakes production changes regardless of mode. In the other direction, DevOps users report false positives on ordinary Terraform, kubectl, and SSH work, which forces mode-switching or trusted-environment configuration. Conversational boundaries can be lost when context compacts, so durable rules belong in ask and deny lists, not in chat. And there are rollout reports of configured defaults being ignored; those are bugs, not intended behavior, and worth a client update before deeper tuning. The pattern is right. The gate, like every gate, earns trust by being watched.