Claude Code Auto Mode Default and Cross-Session Messaging

Anthropic didn't flip Auto Mode to default on a hunch. In a controlled study of 1,053 paid testers, human reviewers caught just 13.6% of dangerous commands under manual approval, a rate that fell to roughly 5% once a session had accumulated 50 prompts - the classic approval-fatigue curve. The separate classifier that now screens every risky tool call caught 89% of the same commands ^[1].

That gap sits next to a habit Anthropic's own telemetry surfaces: users approve 97% of permission prompts regardless of content, which makes the old safeguard closer to a formality than a real check ^[1]. An independent developer analysis made a blunter version of the same point months earlier, arguing the human-in-the-loop had effectively vanished before Auto Mode existed because manual prompts were routinely clicked through without scrutiny ^[2].

Anthropic frames the flip in outcome terms too: the share of sessions containing an unrequested harmful action fell from 6.3% under manual approval to 2.4% under Auto Mode, and Team and Enterprise customers running Auto Mode ship about 25% more pull requests than those who don't ^[1]. Trade press coverage corroborated the timeline and the headline classifier numbers ahead of the August 14 switch ^[3].

The mechanism behind Auto Mode isn't Claude grading its own homework. Anthropic describes the classifier as a separate model that reviews only the user's messages and Claude's proposed tool calls - never Claude's internal reasoning - specifically watching for a proposed action that reaches further than what the user actually asked for. Not every action reaches the classifier: read-only or easily reversible steps skip review entirely, while shell commands, external network calls, and other higher-risk moves get screened first.

A second, independent layer scans any web page or file Claude fetches for hidden prompt-injection instructions before that content ever enters Claude's context window. Anthropic reports zero successful prompt-injection attacks against Claude models running with both layers active in its own testing, against a 5.83% success rate for a comparison model ^[1]. The guardrails extend past the classifier itself: Auto Mode ships with more than 20 built-in block rules covering force pushes, mass cloud-resource deletion, credential exfiltration, production deploys, and permission-escalation attempts ^[4].

The same window Anthropic published its safety numbers, security vendor Salt Security disclosed a remote-code-execution exploit against Claude Code's Auto Mode, affecting CLI versions 2.1.116 through 2.1.199 as well as Codex CLI 0.142.4 - and it worked, unmodified, against Claude Sonnet 4.6, Sonnet 5, Opus 4.8, and GPT-5.5, spanning two vendors and four model generations ^[5].

Salt Security CEO Roey Eliyahu argued the reproducibility is itself the finding: 'When the same attack works unchanged across two vendors and four model generations, you are not looking at a software bug - you are looking at a structural property' ^[5]. That's a harder problem than a single patch, and it sits uncomfortably next to Anthropic's own acknowledgment that its classifier reduces but does not eliminate risk.

Auto Mode's default flip lands in the same window as a second, seemingly complementary feature: cross-session messaging, which lets one Claude Code session hand a plain-text note to another of a user's sessions - a status update or a warning about a breaking change - without sharing full conversation history or files, through new ListAgents and SendMessage tools ^[6].

Anthropic's own documentation draws a hard line around it: a message from another session can never substitute for user consent, cannot change permission settings or CLAUDE.md, and inbound messages are held or refused by default whenever the receiving session is running with permission prompts bypassed - a safeguard against one already-bypassed session directing another ^[6].

A related tension already shows up elsewhere in Claude Code's broader session-messaging ecosystem. Developer discussion on Reddit describes a separate, Desktop-native tool set - list_sessions, search_session_transcripts, send_message, archive_session - that requires Ask Permission or Accept Edits mode with a manual click to approve every single message, and explicitly does not work in Auto or Bypass mode. The tool names differ from the newly documented ListAgents/SendMessage pair, so it isn't clear the two are the same mechanism, but the pattern is instructive either way: session-to-session coordination features in Claude Code have a track record of assuming a human is present to click approve, the exact assumption Auto Mode is built to remove.

Anthropic isn't flipping the switch everywhere at once. The August 14 default applies only to Pro, Max, and Team plan sessions; Claude Enterprise, the Claude API, and cloud-partner platforms - AWS's Claude Platform, Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry - keep Auto Mode as opt-in for now, with Anthropic saying it plans to make it the default there too within the coming month ^[1].

Anyone who had already pinned a different permission mode as their personal default gets, at most, a one-time prompt asking whether they want to switch; if a default is already pinned, nothing changes automatically ^[1]. The staggered rollout reads as a tacit acknowledgment that regulated and infrastructure-heavy environments warrant a longer review window before the default extends to them.