Claude Code makes auto mode default, cites 89% attack block rate
Anthropic is making auto mode the default setting for new Claude Code sessions on the Pro, Max, and Team plans starting August 14th, ending the practice of asking users to approve most actions step by step. Blogger Simon Willison covered the change alongside newly published Anthropic safety evals. At a Fireside Chat with Cat Wu and Thariq Shihipar at the AI Engineer World's Fair, Willison had asked how Anthropic runs Claude Code safely internally given the risk of prompt injection. Cat Wu and Thariq Shihipar answered that "broadly within Anthropic, almost every single person uses auto mode," and Cat Wu then added that Anthropic had "pretty much mitigated every attack" for the main risk categories it worries about, prompt injection and data exfiltration, to a level she said is far lower risk than the average human reviewer.
The evals Anthropic then published back that claim with two tests. In the first, 1,053 paid testers each had a single permission prompt swapped mid-session for a command that was clearly dangerous, and Anthropic recorded whether the tester approved it. Only 13.6% of the human testers refused the harmful action; auto mode would have blocked 89% of the same actions, meaning it still would not have stopped roughly 11% of cases. In the second test, Anthropic commissioned third party Trajectory Labs to run 72 indirect prompt injection scenarios, held out from Anthropic itself, against the latest publicly available versions of Claude Code and Codex as of July 17th, 2026. Across 720 total attack attempts, none succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode. Thariq Shihipar later joked on Twitter that Anthropic "should have called this post 'defeating the lethal trifecta.'"
Willison, who has publicly predicted a security disaster for coding agents in 2026, said he wants independent confirmation before accepting that Anthropic has solved prompt injection for Claude Code users. He agrees auto mode beats constant human approval, since "confirmation fatigue" makes people bad gatekeepers, but he separately worries about a scenario the evals do not obviously cover: a malicious third-party package that instructs the agent to fetch and run an attacker-controlled tool, such as a fake dependency, before running a test suite, exfiltrating data in the process. He says he is not sure how any version of auto mode would catch that kind of attack.
Key facts
- Auto mode becomes the default for new Claude Code sessions on Pro, Max, and Team plans starting August 14th.
- In a test of 1,053 paid testers, only 13.6% refused a permission prompt swapped for a clearly dangerous command; auto mode would have blocked 89% of those same actions.
- Third party Trajectory Labs ran 72 indirect prompt injection scenarios against Claude Code and Codex (versions as of July 17th, 2026); none of 720 total attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode.
- Cat Wu and Thariq Shihipar say almost everyone inside Anthropic already uses auto mode, and Cat Wu adds that its risk on prompt injection and data exfiltration is far lower than an average human reviewer's.
- Simon Willison wants independent confirmation and flags a hypothetical malicious-package attack, fetching and running an attacker-controlled tool before a test suite, that he is unsure auto mode would stop.
Why it matters
Anthropic is flipping the default behavior of its own coding agent from step-by-step human approval to unsupervised operation for most of its paying Claude Code users. That is a bet that autonomous action, backed by evals, beats routine human review, and it is one Anthropic says its own staff already make internally.
Who it affects
Anyone on Claude Code's Pro, Max, or Team plans starting new sessions from August 14th; auto mode becomes what they get unless they change it. Anthropic's own engineers already work this way, according to Cat Wu and Thariq Shihipar's comments at the AI Engineer World's Fair.
How to use it
The change requires no action: it is a default switch, not an opt-in feature, and takes effect for new sessions from August 14th. The source does not describe pricing, a configuration toggle, or how to revert to prompt-by-prompt approval.
How solid is it
Anthropic backs the switch with two evals: a live test where only 13.6% of 1,053 paid human testers refused a swapped-in dangerous command, versus an 89% block rate for auto mode, and a third-party test by Trajectory Labs in which none of 720 indirect prompt injection attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode across 72 held-out scenarios.
Risks and caveats
Auto mode's own 89% figure leaves roughly 11% of dangerous actions it would not have blocked in the human-comparison test. Willison, who predicted a 2026 security disaster for coding agents, wants independent verification beyond Anthropic-commissioned evals and describes a malicious third-party package that tricks an agent into fetching and running attacker code before a test suite runs, an attack class he is not convinced any version of auto mode would catch.
“Broadly within Anthropic, almost every single person uses auto mode”
— Cat Wu and Thariq Shihipar, Anthropic