Scale · founder · 7 min read

Your coding agent now approves its own actions

Claude Code flipped to auto mode by default on August 14. An AI now decides what your agent is allowed to do. Here's the founder's read.

Published August 14, 2026 ·

security AI agents claude-code permissions

Today, August 14, Claude Code starts new sessions in auto mode by default for anyone on Pro, Max, or Team. That means the permission prompts — “Claude wants to run this command, allow?” — mostly stop appearing. In their place, a separate AI classifier inspects each action and decides whether it’s safe enough to proceed.

If you don’t use Claude Code, don’t skip this. The same shift is already live in OpenAI’s Codex, and it’s coming to every agent you run. The interesting part isn’t the feature. It’s the reason Anthropic gave for shipping it.

The number that should bother you

Anthropic says developers approve 97% of permission prompts in Claude Code.

Sit with that. The safety mechanism everyone points to when they say “don’t worry, the agent asks before it does anything dangerous” — people click yes 97 times out of 100. Anthropic also found that a meaningful share of users had already gone into settings and weakened or disabled permission checks entirely, because the prompts were slowing them down.

That’s not a Claude Code problem. That’s what happens to every interstitial that fires too often. Cookie banners, UAC dialogs, TLS warnings, App Store permission requests — the moment a prompt appears more often than it means something, the human stops reading it. We’ve known this about security UX for twenty years. Agent tools rediscovered it in eighteen months.

So the argument for auto mode isn’t “AI is better than humans at judging risk in the abstract.” It’s “AI is better than a human who has already stopped looking.” Those are very different claims, and only the second one is being made.

What the evidence actually shows

Anthropic ran a controlled study with 1,053 paid professional testers, feeding both humans and the classifier a set of dangerous commands.

• Human testers blocked 13.6% of the dangerous commands.
• The classifier blocked 89%.

On analysis of flagged real-world sessions, manual approval was more than twice as likely as auto mode to end in a harmful action the user hadn’t asked for.

The prompt-injection results are the ones worth writing down. Prompt injection is where malicious instructions hidden in a web page, README, or issue comment trick your agent into doing something you never asked for — the security problem underneath most 2026 agent incidents. An independent evaluation by Trajectory Labs ran 720 prompt-injection attacks:

• Claude in auto mode: 0 successes.
• GPT-5.6 Sol in Codex auto-review mode: 5.83% success rate.
• Codex in full-access mode: 19.03% success rate.

Trajectory Labs is clear that this measures the model plus classifier, not the full set of safeguards a given product wraps around it. But the direction is consistent: a reviewing agent catches things a distracted human does not.

What auto mode is not

Three things get conflated in the coverage, and the distinctions matter if you’re deciding whether to leave it on.

It is not a permission expansion. Auto mode changes who approves an action that already required approval. It doesn’t widen what the agent is allowed to touch, doesn’t turn on network access, and doesn’t unprotect protected paths. Same fence, different gatekeeper. OpenAI makes the identical point about Codex’s auto-review: reviewer swap, not permission grant.

It is not perfect. Anthropic worked with Apollo Research on adversarial testing and got the classifier’s miss rate down from 12% to 7%. Seven percent of deliberately malicious, deliberately weird attacks still get through. Those attacks were designed to be nastier than real-world use, but 7% is not 0%.

It is not unsupervised forever. If the classifier blocks three actions in a row, or twenty in one session, Claude falls back to manual approvals. That’s a sensible circuit breaker — a session that keeps trying blocked things is a session that needs a human.

What this means for you

If you run Claude Code yourself, you’ll notice fewer interruptions and longer autonomous runs starting today. If you’d previously set a non-default permission mode, you get a one-time prompt asking whether to switch. You can decline. Anthropic isn’t charging for the classifier’s extra tokens, so this doesn’t quietly eat your usage limits.

If you have contractors or an agency running agents on your codebase, ask them which mode they’re in. Not because auto mode is wrong — the evidence says it’s the safer default — but because “we’re in full-access mode with permissions disabled” is a real answer some people will give you, and that’s the 19% column.

If your agent touches production, keep a human in the loop regardless. Anthropic’s own recommendation is to review before high-risk changes: production systems, live customer data, anything you can’t roll back. Auto mode is calibrated for the ordinary case, and your deploy step is not the ordinary case.

If you’re evaluating tools, the Trajectory Labs numbers are a legitimate input. Prompt-injection resistance has gone from an academic footnote to something with a measurable spread between vendors. Ask about it.

The uncomfortable part

There’s a version of this story that reads as an admission. The permission prompt was the thing standing between an autonomous agent and your filesystem, and it turns out it was theatre — a checkbox people clicked 97% of the time. Replacing it with a classifier is honest engineering: it fixes a control that had already failed.

But notice where it leaves you. Your safety layer is now a model evaluating another model, and you have no direct visibility into either decision. The 89%-versus-13.6% comparison is real, and it’s a genuine improvement over the status quo. It’s also a comparison against a baseline that was close to zero. “Better than a human who wasn’t looking” is a low bar to clear and a strange thing to build your risk posture on.

The practical answer isn’t to turn auto mode off — the data says that makes you less safe, not more. It’s to stop treating the approval step as your security model at all. Scope what the agent can reach. Keep production behind a gate a machine can’t open. Assume anything the agent reads might be trying to instruct it. Those controls don’t care which mode you’re in.

Auto mode is a better default. It isn’t a plan.