AIREITEROn Oct 22, Anthropic announced auto mode would become the default for new sessions in most Claude apps the following week on Pro, Max, and Team plans. Enterprise admins get an email first, and API and cloud platforms stay opt-in for now.
What changed on Oct 22, and what did not
The Oct 22 update expands a Claude Code change to most Claude apps. Starting August 14, 2026, new Claude Code sessions on Pro, Max, and Team plans started in auto mode, with a one-time prompt for users who had pinned a different default. The October 22 note on the same Anthropic announcement says auto mode rolls out next week as the default for new sessions in most Claude apps on Pro, Max, and Team plans, with Enterprise admins notified by email before their organizations change.
Three boundaries did not move. Team admins who pinned a default in managed settings see no change for their users. Enterprise, the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry remain opt-in, with a plan to make auto mode the default there in the coming month. Pinned personal defaults also survive unless the user accepts the one-time switch prompt.
Version floors matter for what users see. Claude Code v2.1.283 and later list auto as the built-in starting mode for interactive terminal and VS Code sessions when no permission mode is configured, per release-notes tracking. A fresh install can still start in manual mode on first launch if feature flags have not arrived yet.
How Claude auto mode decides
Claude auto mode routes each tool call through a separate classifier instead of asking for approval at each step, per Anthropic's announcement. The classifier permits routine actions and blocks actions judged irreversible, destructive, or aimed outside the working environment, and Claude then finds a safer path or asks directly. Sessions that hit three blocks in a row or twenty blocks across a session fall back to manual approvals.
Explicit permission rules still fire before the classifier in Claude auto mode. Entries in permissions.deny block outright and no classifier verdict can override them, while entries in permissions.ask always prompt. Broad allow rules that grant arbitrary code execution, such as Bash(python:*), are set aside while auto mode is active so commands cannot skip the classifier entirely.
The classifier carries more context than a static allowlist. Anthropic says the classifier checks the destination of a git push or pull request (private, trusted, or public) before the action runs, and checks current git status before destructive commands such as git reset --hard.
External content from web pages, file contents, or tool outputs passes through a prompt-injection probe, with a warning added to Claude's context when something looks like an injection attempt. Data exfiltration sits in a hard-deny category that is not auto-approved; running such an action requires switching modes or running the command directly.
Why Anthropic says auto beats clicking Approve
Anthropic frames the change as ergonomics backed by measurement. Users approve 97% of permission prompts in Claude Code, while rejecting 39% of presented plans, a gap Anthropic reads as reflexive clicking on single prompts rather than review. As of June 2026, 49.5% of active CLI users had hand-written a Bash allow rule, 62% had used bypassPermissions or "don't ask again," and 25% of interactive sessions started in bypass mode.
The controlled study put numbers on the habit. Anthropic hired 1,053 paid testers through a research vendor, swapped one permission prompt per session for a clearly dangerous command, and recorded the response; the dangerous text executed nothing. Humans caught the command 13.6% of the time (143 of 1,053), while auto mode blocked 89% of the same commands (937 of 1,053).
Head to head, auto mode blocked 800 commands the humans approved, while humans blocked only 6 that auto mode allowed, and human performance fell from about 17% early to about 5% after 50 or more prior prompts while auto mode stayed flat.
Production and third-party data point the same direction, per Anthropic's announcement. Among flagged sessions from May to June 2026, 6.3% of manually approved sessions contained production-level harm the user had not explicitly requested, versus 2.4% of auto-mode sessions. Trajectory Labs ran 72 prompt-injection scenarios ten times each: zero of 720 attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 in auto mode, versus a 5.83% success rate against GPT-5.6 Sol in Codex Auto-review mode.
Apollo Research red-teaming cut the classifier miss rate from 12% to 7% after hardening with repository visibility, git state, and data-handling rules. Anthropic also cites three internal saves (an off-network upload fallback to a public paste site, a mass process kill across roughly 2,000 pods threatening GPU training jobs, and an over-broad billing-role escalation) plus about 25% more pull requests among Teams and Enterprise adopters including Adobe, Nuro, Gusto, and Garner Health.
What users run into after switching
Real-user threads add friction the announcement does not dwell on. Routine operations draw the most complaints: commits, worktree cleanup, SSH and server work, and deployment commands getting blocked or re-prompted in auto mode.
"the auto classifier is asking permission for even the most basic operations, and still won't do them even after giving explicit permission." — u/dfritter4 on r/ClaudeCode
Approval not overriding a denial is the sharpest edge. Several users report approving an action and watching the harness refuse it anyway, which forces a detour through manual mode or the terminal.
"I had situations where I had to put it back on manual, tell the agent to keep going, manually approve, then go back to auto." — u/phoenixmatrix on r/ClaudeCode
Classifier outages form a separate category from safety denials. In one multi-project incident, users saw "The server-side auto mode classifier gave no verdict" across projects while the status page showed no incident, and the workaround was switching to manual mode until service recovered.
Quality worries round out the list, raised in the default-rollout discussion. Some users care less about destructive commands than about Claude overengineering, drifting scope, or weak architecture while running autonomously, and repeated friction pushes a minority back toward --dangerously-skip-permissions guarded only by git, containers, and review-before-merge.
Keep checkpoints without leaving Claude auto mode
The default that surprises most developers is that pushes and pull-request creation are allowed in Claude auto mode, including pushes to the branch being worked on and the default branch. Force pushes, secrets appearing in commits, and history rewrites stay soft-blocked and need explicit intent. Saying "clean up the repo" does not authorize a force push, while naming the exact action does. Branch names that mark deploy targets such as production, release, or gh-pages are judged on their own terms as production deploys.
To keep auto mode for everything except pushes and PRs, add content-scoped ask rules that are evaluated before the classifier:
{ "permissions": { "ask": ["Bash(git push *)", "Bash(gh pr create *)"] } }For a boundary that must not be crossed, use permissions.deny rather than chat instructions. A spoken "don't push until I review" can vanish when context compacts, but an ask or deny rule persists. Repeated denials for a known destination usually mean the classifier does not recognize the infrastructure; naming it in autoMode.environment in user or managed settings helps.
Review denials under the Recently denied tab in /permissions and press r to retry one, and audit setup with claude auto-mode config, claude auto-mode defaults, and claude auto-mode critique. Two gotchas: narrow allow rules such as Bash(npm test) resolve before the classifier and can let a destructive argument through unseen (set autoMode.classifyAllShell to true on v2.1.193 or later to classify each shell command at some latency cost), and custom allow, soft_deny, hard_deny, or environment lists replace the built-ins entirely unless they keep the literal "$defaults" entry.
Turn it off when you need to
Per-session switching in Claude auto mode takes one gesture. Press Shift+Tab in the CLI to cycle modes or use the mode dropdown in the desktop app, or start a session with claude --permission-mode manual. The change applies to the current session only.
To pin manual mode permanently, save the default in user settings at ~/.claude/settings.json:
{ "permissions": { "defaultMode": "manual" } }The value manual is an alias for default on v2.1.200 and later. Repository-level .claude/settings.json cannot grant or pin auto mode: defaultMode: auto and bypassPermissions set there are ignored, so the opt-in or opt-out belongs in user or managed settings. Organization admins pin the org default with defaultMode in managed settings or remove auto mode entirely with permissions.disableAutoMode set to "disable", which since v2.1.251 applies even to sessions already running. The auto-mode classifier also reviews shell commands during plan mode when useAutoModeDuringPlan is on, which is the default where auto mode is available.
Leave it on or pin manual?
Match the mode to blast radius, not to enthusiasm. Solo scratch work, isolated local refactors, dependency bumps, test generation, and docs cleanup with a diff and test suite as the gate are the natural home for auto mode. Shared team repos add one precondition: protected paths, hard denies for secrets and deploy manifests, and sandboxes or throwaway branches agreed before rollout.
| Workflow | Recommended mode | Guardrail to set first |
|---|---|---|
| Solo exploration, reversible edits | Auto mode | Recently denied review + r retry habit |
| Team repo, routine feature work | Auto mode with push checkpoints | ask on git push * and gh pr create * |
| Production deploys, IAM, secrets, incident response | Manual or plan mode + human diff review | deny rules for never-cross boundaries |
| Regulated or HIPAA-eligible sessions | Manual (auto stays available to switch to) | Managed defaultMode + audit who can change it |
Update CLI and editor integrations to the same release train, set one managed default, define protected paths and hard denies, run first passes in devcontainers or isolated VMs with fake data, and keep git diff, test runs, and a real review as the gate before merge. About 10% of sessions since mid-May include a classifier denial, per Anthropic.
FAQ
Does Claude auto mode cost extra tokens?
No extra charge applies on Pro, Max, and Team plans, per Anthropic effective August 7, 2026. Enterprise, API, and cloud-platform sessions still count client-side classifier calls toward token usage.
What should I do when auto mode blocks legitimate work?
Open /permissions, check the Recently denied tab, and press r to retry the denial. Name trusted infrastructure in autoMode.environment if the same destination keeps getting denied.
Why did a push to main go through without a prompt?
Pushes to any branch of the working repo, including the default branch, are allowed by default in auto mode. Add Bash(git push *) to permissions.ask to force a checkpoint, or to permissions.deny for a hard boundary.
Is auto mode safe for production work?
Anthropic positions auto mode as safer than habitual clicking but still recommends human review for high-stakes production infrastructure changes. Keep auto mode on reversible work and manual or plan mode on deploys, secrets, and IAM.
How do I tell a safety denial from a classifier outage?
A safety denial names the blocking concern and Claude usually proposes another route; a "no verdict" outage blocks writes and Bash actions across projects at once. Check /status for the auto-mode server row and try manual mode if an outage is suspected.
Does auto mode work the same in Claude Code and the Claude apps?
The classifier mechanism is shared, but rollout timing differs: Claude Code moved first on August 14, the Claude apps follow next week, and Enterprise and API surfaces stay opt-in until admins are notified.
Related reading: OpenAI Codex auto mode guide