Anthropic is about to change how millions of developers answer permission prompts without most of them noticing. Starting this month, new Claude Code sessions for Pro, Max, and Team users will launch in auto mode by default. Every tool call will pass through a risk classifier before it executes — and if your allow-list looks like most allow-lists do, that classifier is about to become the real gatekeeper of your machine.
The numbers behind the switch are blunt. Users approve 97% of permission prompts and reject just 3%, and the longer a session runs, the more reflexive the clicking becomes. In Anthropic's controlled test with 1,053 paid testers, human reviewers caught only 13.6% of dangerous commands. Auto mode caught 89%.
What Auto Mode Is — and What It Isn't
First, the boundary: auto mode is not bypassPermissions. Every tool call still passes through a risk classifier before execution. Hard-deny categories — data exfiltration being the canonical example — are never auto-approved under any circumstances; the classifier will stop them, and you must consciously switch out of auto mode to run them.
Rollout mechanics are twofold. If you have never set a default permission mode, new sessions will start in auto mode and tell you so. If you have configured a different default, you will get a one-time prompt asking how to proceed.
The classifier adds a small amount of token overhead to each call. Anthropic absorbs that cost; it does not appear on your bill.
Five Things to Fix Before the Default Lands
1. Memorize the Escape Hatch
In the CLI, Shift+Tab cycles through permission modes; the desktop app exposes the same thing as a mode dropdown. When auto mode feels too aggressive — or not aggressive enough — this is your immediate way out. Muscle memory here matters more than settings screens.
2. Team Admins: Pin It or Kill It
Team workspace administrators can set an organization-wide default in managed settings, or disable auto mode entirely:
// managed settings (admin)
{
"defaultMode": "acceptEdits", // pin the org-wide default
"disableAutoMode": true // or turn the feature off altogether
}If your organization has compliance requirements around code execution, decide this deliberately before your developers' sessions decide it for them.
3. Audit Your Bash Allow-Rules — Most Are Too Wide
Anthropic's own telemetry shows why this switch is risky for exactly the people who think they have already configured things safely. As of June 2026, 49.5% of active CLI users have hand-written Bash allow-rules. Five percent of those rules allow arbitrary shell commands outright, and 43% use interpreter-level patterns like Bash(python:) or Bash(node:) — which in practice is nearly the same as allowing everything, since an interpreter can do anything the shell can. The share is growing five percentage points every five weeks.
The fix is to tighten patterns before the default flips. Constrain by interpreter scope and by path:
// settings.json — narrow the rules
{
"permissions": {
"allow": [
"Bash(python:*)", // scope the interpreter, not bare Bash()
"Read(~/project/**)", // path-scoped reads
"Edit(~/project/**)"
]
}
}4. Extend the Hard-Deny List
Data exfiltration is hard-denied out of the box: the classifier will never approve it, and execution requires leaving auto mode. That list is extensible. Sensitive directories, destructive one-liners, anything your organization treats as never-run — put it in always-deny explicitly rather than trusting the classifier to infer your risk appetite. An explicit deny rule costs one line today and saves an incident report later.
5. Know the New Safety Checks Riding Along
- Repository visibility check. Before
git pushor opening a PR, Claude Code now confirms whether the target repo is public, private, or trusted. - git status pre-read. Before commands that can discard uncommitted work —
git reset --hardbeing the classic — the current status is read first. - Injection probing. When Claude fetches web pages, files, or tool output, API-side probes scan for injection attempts and raise a flag before the content enters context.
What This Changes for Teams and Cloud Users
Auto mode lowers risk; it does not eliminate it. Anthropic's own guidance is that high-risk changes to production infrastructure still deserve human review of what Claude intends to execute. The 89% catch rate is excellent relative to 13.6%, but the remaining 11% is exactly the tail where your judgment is worth more than a classifier's.
Cloud platform channels are next in line. Auto mode is currently opt-in for AWS, Google Cloud, and Azure deployments of Claude Code, and Anthropic has given those channels a month before the same default lands. Teams deploying through cloud partners should treat this window as their preparation period.
The deeper lesson in the rollout data is about all of us: testers approved 97% of prompts while blocking only 13.6% of dangerous commands. Alert fatigue is not a hypothesis; it is measured. A classifier with worse judgment than a careful engineer still outperforms a careless one — and under prompt volume, most of us are careless.
The Takeaway
Default settings are product strategy. By moving auto mode from opt-in to default, Anthropic is betting that the average permission prompt was never a real decision point — just friction — and that automated risk classification is a better use of everyone's attention. The evidence is on their side. Your move now is administrative, not philosophical: tighten the allow-list, extend the deny-list, and learn the escape hatch before the first session opens without asking.
Official announcement: Auto mode is now the default in Claude Code