# Anthropic Makes Automatic Approvals the Default in Claude Code From August 14

The company says its own controlled test found human reviewers caught a planted dangerous command 13.6 percent of the time, against 89 percent for the automated checker.

- Published: 2026-08-10T06:21:58.349Z
- Canonical: https://polylog.news/ai/2026-08-10/anthropic-makes-automatic-approvals-the-default-in-claude-co
- Publisher: Polylog (AI desk)
- Section: tech
- Sources: [Anthropic (Claude blog)](https://claude.com/blog/auto-mode-default-in-claude-code), [TechCrunch](https://techcrunch.com/2026/08/09/anthropic-is-turning-claude-codes-auto-mode-on-by-default/)

Anthropic will make auto mode the default setting in Claude Code for Pro, Max and Team subscribers starting August 14, [the company said](https://claude.com/blog/auto-mode-default-in-claude-code). In that mode the coding agent stops asking for step-by-step approval and proceeds on its own unless an action is judged irreversible, destructive, or directed outside the user's environment. Enterprise customers, the application programming interface (API) and the cloud platform deployments keep the current behavior for now, with a default rollout there planned within about a month, [TechCrunch reported](https://techcrunch.com/2026/08/09/anthropic-is-turning-claude-codes-auto-mode-on-by-default/).

The justification is an argument about human attention rather than about model capability. Anthropic says users approve roughly 97 percent of permission prompts. In a controlled test with paid users, reviewers noticed a deliberately planted dangerous command 13.6 percent of the time, while the automated policy checker flagged it 89 percent of the time. Independent developer [Simon Willison flagged the change](https://simonwillison.net/2026/Aug/8/auto-mode/) as it went out.

Those numbers come from the vendor and have not been reproduced outside Anthropic. The result is also narrower than it sounds: it measures detection of an injected malicious command inside a controlled task, not the broader class of quiet errors an unsupervised agent can commit across a repository. What is verified is the policy change and its date. What is asserted is that the automated gate is a strict improvement on the human one.

The direction of travel is clear either way. The industry's most widely used coding agent is moving its default from ask-first to act-first, and the safety case rests on a classifier rather than on a person.

## What this means

The gate on agent autonomy is moving from user consent to vendor policy, which shifts the failure mode from "developer approves something careless" to "vendor classifier misjudges something." Anthropic gains throughput and user retention, since agents that run uninterrupted complete longer tasks and use more tokens per session, which supports Claude Code revenue. The exposure sits with teams whose repositories, credentials and cloud accounts are reachable from a developer laptop, and with security vendors now selling controls for a workflow whose default assumption has changed. Enterprise buyers who are already slower to adopt get a delayed rollout, which shows where Anthropic expects the procurement resistance.

## What to watch

- Whether any outside group reproduces the 89 percent versus 13.6 percent comparison on tasks Anthropic did not design, which is what would turn a vendor claim into an accepted result.
- Whether OpenAI, Google and Cursor follow with act-first defaults in their own coding agents, which would signal that permission prompts are being abandoned industry-wide rather than at one vendor.
- The first publicly documented incident of an unsupervised agent damaging a production system under a default setting, and whether liability lands on the vendor or the user.