Claude more often finds a route of its own and keeps running instead of stopping at a small question. That is my own observation from working in Claude Code.
Anthropic describes the behaviour in their own words: when auto mode blocks an action, Claude finds a safer alternative or asks the user for approval directly. The two are consistent, but they are not the same claim. Their sentence is about what happens after the classifier has stopped something, and it also covers the case where Claude stops and asks by itself.
What changed is not what Claude may do. It is when you decide it.
TL;DR. Four things follow from one another once the default moves:
- You approve far less often.
- Claude picks its own route onward.
- Everything outside the line gets done by a route you did not choose.
- The control sits in the line, written in advance.
On by default for new sessions: Pro, Max and Team since 14 August 2026. Still opt-in: Enterprise, the Claude API, Claude Platform on AWS, Bedrock, Google Cloud Agent Platform and Microsoft Foundry, checked 2 September 2026.
Anthropic: auto mode becomes the default in Claude Code, 7 August 2026 →
What happens when you approve less often
Auto mode routes Claude's tool calls through a classifier instead of asking you. The classifier blocks what is irreversible, destructive or outside the environment Claude is working in. When something is blocked, Claude either finds another route or asks for approval. It is not a free pass: the classifier works inside the guardrails your engineers configure. You switch mode with Shift+Tab in the terminal or the mode menu on desktop, and an administrator can pin defaultMode in managed settings or turn the feature off entirely with disableAutoMode.
It is still human in the loop AI. The loop has simply moved. The human used to sit inside the run, saying yes or no as it went. The human now sits in front of the run and writes down what may happen in it at all.
Kai Zhou at Nuro describes what that does to a working day: he keeps three or four sessions running in auto mode at once and checks in when he needs to. That is a different job from clicking approve. The first is watching several tracks. The second is standing in one.
Two things follow directly. You approve far less often, and Claude picks its own route onward when the first one is closed.
The click had already been switched off
The default is new. The behaviour is not. Anthropic's own figures for how people were already using Claude Code: 62 percent have used bypassPermissions or dismissed a dialog with "don't ask again". 25 percent of interactive sessions start in bypass. 49.5 percent have written their own Bash allow-rules. 5 percent permit any shell command at all. 43 percent have interpreter rules such as Bash(python:*).
Once approval becomes a click that repeats itself hundreds of times, it stops being a decision. That is what Anthropic's own measurements show too. In a controlled study over 1,053 dangerous commands, humans stopped 13.6 percent of them, 143 of 1,053. Auto mode stopped 89 percent, 937 of 1,053. The disagreement runs almost entirely one way: auto mode blocked 800 commands that humans had approved, while humans blocked 6 that auto mode allowed. The figures are Anthropic's own, published by them on 7 August 2026.
The average is not the interesting part. The curve is. Early in a session a human stops around 17 percent of the dangerous commands. After 50 or more prior prompts the figure is around 5 percent. The classifier's rate sits flat across the same two measurement points. Attention is a resource that gets spent over a session, and it is the same mechanism that means a scanned skill does not get read by the person installing it. We wrote about the other half of that problem when Anthropic started scanning skills.
There is also a granularity that gets missed. Users approve 97 percent of individual permission prompts and reject 3 percent. When Claude puts up a plan first instead, they reject 39 percent of the plans. People read a plan. An individual action they click through. That says something about where a human is actually able to be useful, and it is not at action number 84.
Consequence three falls out of that: everything outside the line gets done by a route you did not choose.
What cannot be undone
The first class of action is the one with no undo button. Nuro denies recursive deletes outright in its settings, so the question never reaches a human who has to judge it at half past four. At the same time they let research agents run overnight against their driving-evaluation metrics, because there is a clear, measurable signal an agent can iterate against on its own.
That is the same decision twice with two different answers, and the difference is not how important the work is. It is whether the result can be rolled back.
Anthropic's own field data from real sessions in May and June 2026 points the same way: production-level harm, severity 7 and above, appeared in 6.3 percent of manually approved sessions against 2.4 percent of auto mode sessions. Manual approval is not safety in itself. It only feels like it.
The class is not a developer problem either. It generalises immediately: a credit note that has been issued has been issued. There is no button that takes it back, only a new entry and a conversation with a customer. If an agent can issue one, it belongs here.
What hits something live
The second class is anything that touches a system while somebody is using it. Gusto keeps production infrastructure behind a human: Terraform, AWS and direct POST calls against live APIs. In exchange they let Claude work across repositories and run unattended jobs that compile the day's notes from GitHub, Slack and Jira.
Martin Emde at Gusto has run 2,425 sessions since December. About 10 percent of transcripts since mid-May contain an auto mode denial, meaning an action the classifier stopped. Work that used to stall on folder-access approvals now runs uninterrupted.
Those two numbers belong together. A denial rate around 10 percent is not a sign the system is in the way. It is the line doing its job, roughly one time in ten.
This class generalises out of the developer world without effort as well. An integration writing into the booking system your customers are ordering in right now is the same action as a Terraform apply. It can be rolled back, but not before somebody notices, and until then it is true for everyone looking.
You are still responsible for what happens.
The third class is the one that gets left out
The third class is anything that speaks to other people in your name. Garner Health keeps Slack and email behind a human and lets Claude work freely in the research-heavy stages of the development cycle, in the codebase and in their MCP setup.
I don't like Claude to just act on my behalf when I'm communicating with another person.
Kai Zhou at Nuro does the same thing even though his company sits in the first class: he switches back to manual when Claude Code reviews a pull request on his behalf. It is not the code that does it. It is that the review is a statement with his name on it.
That is the class I see skipped when a company writes its first line. Not because it is hard to understand, but because it is the only one of the three where the failure is silent. A wrong Terraform apply announces itself within minutes. A Slack message sent in your name to a customer does not, and nobody rolls it back. It just becomes part of what the customer believes they know about you.
I have a commercial interest in this getting written down, because it is the kind of work I do. It does not change the fact that the third class is the one missing from most first drafts.
Smoother and more exposed are the same mechanism
Auto mode is easier to work with, because I approve manually less often. It is also the same behaviour that lets Claude get further on its own before anyone looks. These are not two properties, one good and one bad. It is one behaviour described twice.
So it is a trade, and the handle is autonomy. Turn it up and you get both the smoother working day and the longer strip of actions that already happened. Turn it down and you get neither.
Which means the intervention sits in one place: which actions fall inside the line at all. Human in the loop AI does not mean a human sees every action. It means a human has settled in advance which actions require a person, and that the decision is written somewhere other people can read it.
Anthropic's own measurements say auto mode catches more dangerous commands than humans did. Those are their figures, and they are therefore an argument for writing the line, not for skipping it.
The fourth class is your own
The three classes are the ones three companies arrived at separately, out of their own business. There is a fourth, and it appears in nobody's blog post, because it turns on something only you know: what is expensive to take back in your house. Write it down alongside the three, and let it live in the same file as the rest of the line.
If you want help writing that line with your team, that is exactly the kind of work I do in internal AI tools. Half a day is usually enough to settle the three classes and find the fourth.
How the work was divided
This work was produced in collaboration with AI. The split below is an informed estimate, not a measured log.
Sources
Anthropic: auto mode becomes the default in Claude Code, 7 August 2026 →
Anthropic: auto mode in production, customer configurations, 7 August 2026 →
Claude Code for enterprise, checked 2 September 2026 →
Brinvik: Anthropic now scans skills. Five piles, one gets checked →
Brinvik: EU AI Act, what your company must do now →
FAQ
Frequently asked questions
Bypass switches approval off. Auto mode moves it. In bypass everything runs unchecked. In auto mode every tool call goes through a classifier that blocks the irreversible, the destructive and anything reaching outside the working environment, and Claude then finds a safer alternative or asks for approval. Chad Kunsman at Gusto prefers auto mode to bypass for exactly that reason: it protects against prompt injection and checks that what is happening lines up with what was asked for.
If you are on Pro, Max or Team it is the default on new sessions from 14 August 2026. If you are on Enterprise, the Claude API, Claude Platform on AWS, Bedrock, Google Cloud Agent Platform or Microsoft Foundry it is still opt-in, checked on 2 September 2026. On Bedrock, Vertex and Foundry it is available for Opus 4.7 and 4.8 through the environment variable CLAUDE_CODE_ENABLE_AUTO_MODE=1.
Yes. An administrator can pin the mode with `defaultMode` in managed settings so every session starts where you want it, or disable the feature outright with `disableAutoMode`. Both are settings rather than a contract, so they can be changed again the same day.
No, and the figure is Anthropic's own. The 89 percent comes from their controlled study over 1,053 dangerous commands, which they published themselves. A red team from Apollo Research got 12 percent past the classifier, and 7 percent after hardening. At Gusto, auto mode stopped something in about 10 percent of transcripts since mid-May. A classifier that catches more than a tired human is still not one that catches everything.
You are. That is not legal advice, but it is how the people running it in production put it themselves. Chad Kunsman at Gusto says it plainly: you are still responsible for what happens. Which is why the line is a management document and not a technical detail.
Auto mode does not change where your data sits, and a classifier blocking a shell command is not an automated decision about a data subject. The requirements still come from the same places: where data is processed, who the processor is, and what you have to be transparent about. We wrote it out in [the walkthrough of the EU AI Act transparency rules](/en/journal/eu-ai-act-transparency-rules-august-2026).
Three classes hold up in practice. What cannot be undone. What hits something live. What speaks in your name. Write them down as classes of action rather than as a list of tools, and they survive the tools changing. Then add the fourth one that only applies to you.
