Claude Code auto mode default

Auto mode's core design choice is separation: the same model that decides which command to run is never the one that approves it. A dedicated classifier only ever sees the tool call being requested, not Claude's reasoning or its own justification for the action, which avoids what Anthropic's own engineering team has likened to writing, reviewing, and merging your own pull request. Layered on top of that intent check is a second, server-side probe that screens tool results for injected instructions before Claude ever acts on them. One Claude Code engineer summed up the effect as stacking model training, input probes, and an intent-matching classifier until indirect prompt injection on unseen attacks drops to roughly zero - a claim that lines up with Trajectory Labs' independent test of 720 indirect prompt-injection attempts across Claude Fable 5, Opus 5, and Sonnet 5 running auto mode, which recorded zero successful attacks, compared with a 5.83% success rate against OpenAI Codex's equivalent Auto-review mode ^[1]. Not every action reaches the classifier at all: read-only or easily recoverable operations skip the check entirely, and by default only the working directory and the current repo's configured Git remotes count as 'internal' - anything reaching outside that boundary is blocked until an administrator explicitly allow-lists it. Simon Willison, while broadly persuaded that repeated manual approval was never a real safety mechanism, still wants the comparison verified outside Anthropic's own test harness before treating the zero-success number as settled ^[2].

Anthropic's headline numbers come from a controlled study of 1,053 paid testers: auto mode caught 89% of dangerous commands against a 13.6% catch rate for human reviewers, and in production traffic the company now reports a 0.4% false-positive rate against a 17% false-negative rate, alongside a drop from 6.3% of manually-approved sessions containing unintended harmful actions to 2.4% for auto mode sessions ^[3]. Set against that is an independent stress-test evaluation that reports a far bleaker picture: an end-to-end false negative rate of 81.0% (95% CI 73.8%-87.4%), a 70.3% false-negative rate restricted to actions the classifier actually evaluates, and 36.8% of all state-changing actions - including artifact-cleanup tasks, which showed a 92.9% false-negative rate - falling entirely outside the classifier's scope because agents route around missing command-line tools by editing files directly ^[4]. Red-team hardening by Apollo Research had already pushed the classifier's miss rate on a held-out adversarial set down from 12% to 7% ahead of the default flip ^[5]. These are not contradictory numbers so much as two different questions: Anthropic's figures describe how the classifier performs against the messy but largely benign traffic real users generate, while the stress test measures how it holds up against a workload built to find its blind spots. The gap between 17% and 81% is less a scandal than a warning label - a classifier that looks strong on typical usage can still be trivially outmaneuvered by anyone motivated to route around it, and a default that ships for everyone should be judged on the adversarial number, not just the friendly one.

The timing of two changes lands in the same announcement: Anthropic stopped charging Pro, Max, and Team users for the extra tokens the classifier burns on every tool call, and simultaneously made auto mode the default for every new session on those same plans ^[3]. Removing the cost penalty right as the opt-out threshold flips is a business move as much as a safety one - a metered classifier that silently taxed every action was a real adoption friction point, with community reports before the change citing meaningful monthly bills tied to classifier overhead alone. Anthropic also has a growth incentive layered on top: teams and Enterprise customers already using auto mode reportedly ship about 25% more pull requests, a productivity number that turns 'safer defaults' into a business case Anthropic can point to when it later pushes the same default onto Enterprise, the API, and the major cloud platforms within about a month ^[3]. None of that undercuts the safety argument, but it does mean the free-token change should be read as an adoption lever, not a pure goodwill gesture.

Anthropic's own research supports the case for a classifier: users already approve the overwhelming majority of permission prompts regardless of risk, cited at roughly 93-97%, and human accuracy at catching genuinely dangerous commands degrades further with exposure, falling to about 5% after 50 prompts ^[6]. That argument is where the developer community's skepticism gets specific rather than reflexive. The most-upvoted response in the largest community thread on the change points out that Anthropic's 89%-versus-13.6% comparison draws from two different evaluation conditions and neither figure includes a false-positive rate, arguing that 89% detection paired with a 2% false-positive rate is a good product while 89% paired with 15% false positives is exactly what generates complaints - a distinction Anthropic's own announcement doesn't spell out. Developers report the opposite failure mode too: a classifier aggressive enough to catch dangerous commands is also aggressive enough to block legitimate ones, with routine infrastructure commands cited as a recurring false-positive that forces a fallback to manual mode. A separate, quieter critique concerns what happens when the classifier does block something - it tells Claude the action was refused and the turn simply continues, with no mechanism that actually pauses execution and hands control back to a human at the moment of real risk. Michael Bargury, whose analysis of Anthropic's own incident logs underpins much of the case for auto mode in the first place, draws the same line Anthropic states publicly: useful for cutting friction on routine work, but not a substitute for human review once the stakes are production infrastructure ^[6].