Anthropic is flipping a big switch. Starting August 14th, auto mode becomes the default setting for new Claude Code sessions on Pro, Max, and Team plans, according to Simon Willison, who covered the announcement and the evals behind it. Auto mode lets the coding agent run actions without stopping to ask you for permission at every step. Anthropic is confident enough in its safety to turn it on for almost everyone by default.
That confidence isn’t coming from nowhere. Willison reports that in an earlier Fireside Chat at the AI Engineer World’s Fair, Anthropic’s Cat Wu told him that “almost every single person” inside Anthropic already runs auto mode, and that the company had “pretty much mitigated every attack” for the main risk categories it worries about.
What the evals actually show
The new data is the interesting part. Two separate tests back the claim.
- Human confirmation fatigue is real. Anthropic ran a test across 1,053 paid testers. Partway through each session, a normal permission prompt was swapped for a clearly dangerous command. Only 13.6% of humans refused it. Auto mode would have blocked 89% of those same actions.
- Prompt injection held up. A third party, Trajectory Labs, tested 72 indirect prompt injection scenarios against the latest public Claude Code and Codex as of July 17th, 2026. None of the 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode.
Anthropic engineer Thariq Shihipar joked on Twitter that they should have titled the post “defeating the lethal trifecta,” a nod to the well-known combo of untrusted content, private data, and the ability to communicate externally.
Why this matters
There are two safety problems in play here, and they’re not the same.
The first is accidental damage. An agent deletes the wrong files or wipes a production database. The second, and the one Willison says he worries about more, is prompt injection: someone hides malicious instructions inside content the agent reads, and the agent follows them thinking they came from a trusted source.
The human test result is the strongest argument for the change. Clicking “OK” every few steps doesn’t produce safe behavior. It produces reflexive approval. If humans wave through dangerous commands 86% of the time, an agent that blocks 89% of them is a clear upgrade over the status quo. That’s the practical case for making auto mode the default.
The honest caveats
Willison is measured about the bigger claim. Blocking 89% of harmful actions still leaves 11% getting through. And while zero successful attacks out of 720 is a strong number, he wants independent confirmation before treating prompt injection as solved.
He sketches one attack he isn’t sure any version of auto mode can stop. A malicious package tells the agent: to run the tests, first fetch model files with a command that pulls in a second package, then run pytest. That second package quietly exfiltrates whatever data it can reach. The instructions look legitimate because they arrive dressed as routine setup steps, and frontier models have proven unnervingly good at finding a way through when they believe the source is credible.
Willison has been on record predicting “a challenger disaster for coding agents security” in 2026. He says he’d genuinely like to be proved wrong by year’s end. His takeaway isn’t to trust the defenses blindly. It’s to double down on running agents so they simply don’t have access to data or tools that can cause harm if something goes wrong.
What to do before August 14
If you run Claude Code on Pro, Max, or Team, a few things are worth checking now:
- Know the default is changing. New sessions will run auto mode unless you configure otherwise. Confirm you’re comfortable with that before the date.
- Sandbox the blast radius. Assume the 11% gap exists. Limit what your agent can touch: scope credentials, avoid pointing it at production, and keep sensitive data out of reach.
- Watch your dependencies. The package-based attack Willison describes is real-world plausible. Be cautious about what third-party code your agent is told to fetch and run.
Anthropic has made a strong, data-backed case that auto mode beats constant human approval. Whether it has truly beaten prompt injection is the question worth watching for the rest of the year. You can find the full evals and Willison’s analysis at the original source.