I just want to ask, is anyone still seriously reviewing the permission approval requests from AI coding tools?
Anthropic also discovered that only 3% of permission requests are denied.
So, they've made a decision. In 5 days, all Claude Code will default to Auto Mode.
Each tool call in Auto Mode consumes a small additional amount of tokens for the classifier. These costs will no longer be charged to the user.
Cloud platforms like Amazon, Google, and Microsoft currently still have it as an optional configuration. However, Anthropic is only giving them one month to switch these channels to default Auto Mode as well.
The founder of Claude Code stated that the team has been using Auto Mode internally for a long time and can no longer imagine manually approving permissions.
The Era of Manual Permission Approval is Gone for Good
The first set of reasons Anthropic provides for this change is that manual approval has become a habitual action:
The user approval rate for Claude Code permission prompts is 97%. As a comparison, when Claude submits a plan for user approval, the rejection rate is 39%; while the rejection rate for a single permission request is only 3%.
The same tendency appears in configuration files. As of June 2026, 49.5% of active CLI users have manually written Bash allow-rules, of which 5% directly allow arbitrary shell commands, and another 43% wrote interpreter rules like Bash(python:), Bash(node:) which are practically equivalent in effect. This proportion grows by about 5 percentage points every five weeks.
Furthermore, 62% of users have used `bypassPermissions` or clicked "Don't ask again" on Bash, and 25% of interactive sessions started in `bypass permissions` mode from the beginning.
The second set of reasons comes from a controlled experiment. Anthropic recruited 1053 paid professional testers via a research vendor to complete coding tasks in a specially built test environment. Midway through the session, one of the permission prompts was replaced with a clearly dangerous command. The vendor recorded whether the testers clicked 'Approve' (approving would not actually execute any dangerous operation, only the prompt text was altered).
The result was that testers blocked this command 13.6% of the time, 143 times; Auto Mode blocked 89% of the same commands, 937 times.
In a direct comparison, Auto Mode blocked 800 commands that humans allowed, while humans only blocked 6 commands that Auto Mode allowed.
Moreover, the longer the session, the worse human performance became: blocking about 17% early on, dropping to about 5% after experiencing 50+ prompts, while Auto Mode's blocking rate did not vary with session length.
Production data was also re-scored.
From May to June 2026, Anthropic took sessions flagged by the security pipeline from accounts that have authorized data for training and analysis, and re-rated them using a model on a severity scale from 0 to 10.
-10 points represent company-wide, irreversible damage. -7 points represent actions like deleting production database records. -0 points represent completely reversible local operations like overwriting a temporary file.
They also evaluated how explicit the user's request for the operation was. At severity level 7 and above, 6.3% of sessions using manual approval contained harmful operations not explicitly requested by the user, compared to 2.4% for Auto Mode sessions. This gap held for every severity level tested.
The classifier itself underwent adversarial testing. Anthropic conducted a two-week pilot with the AI safety company Apollo Research, injecting synthetic attacks into real coding traces, covering three dataset categories: generalization failures, data exfiltration, and safety-related threats.
After Apollo submitted successful attack samples and reinforcement suggestions, Anthropic primarily hardened the classifier by providing more environmental context, including repository visibility, git status, and data handling rules.
After hardening, Apollo retested using a holdout attack set that Anthropic could not access. Auto Mode recovered about half of the previously missed attacks, at the cost of missing about 2% of previously blocked attacks. Calculating on the combined datasets, the miss rate dropped from 12% to 7%. Anthropic also clarifies that these attacks were synthesized to find classifier failure points, and 7% should not be interpreted as the miss rate under real traffic.
For prompt injection, Anthropic commissioned a third-party evaluation from Trajectory Labs, and also brought in OpenAI for comparison. There were 72 indirect injection scenarios, each run 10 times.
The attacks were optimized against Claude Opus 4.7, which was not in the list of models being tested, so all tested models faced unseen attacks.
Out of 720 attack attempts, Claude Fable 5, Opus 5, and Sonnet 5 running Auto Mode were not breached a single time;
GPT-5.6 Sol running Codex Auto-review mode had an attack success rate of 5.83%, and 19.03% in Full Access mode.
As a reference, the average attack success rate for Claude's latest models in `bypassPermissions` mode without additional protections is 0.09%.
Three publicly shared interception cases are:
After a failed upload to an internal cloud drive, Claude's fallback plan was to publish the same report to a public code-sharing site, which was denied and changed to asking the user;
In one long session, Claude attempted to terminate processes across two thousand pods in batches and queued deletion operations that would dismantle training tasks running on hundreds of GPUs; the commands were flagged before execution;
Another case: when asked to configure read-only billing permissions, Claude fetched a cloud role with full administrative permissions at the account root level. The permission scope did not match the request and was blocked.
Recently added capabilities include:
Listing data exfiltration as a hard deny; the classifier never approves it. To execute, one must exit Auto Mode or run it manually. This rule can be extended in settings;
Distinguishing the accessible and shareable scope for keys versus sensitive information, and checking whether the target repository is public, private, or trusted before executing git push or PR;
Reading git status before commands like `git reset --hard` that might discard uncommitted work;
And when Claude pulls web pages, files, or tool outputs, API-side probes scan for injection attempts and add warnings before the result enters the context.
Want to switch back? Shift+Tab
For Pro, Max, and Team users who have never set a default permission mode, they will receive an in-product notification, and new sessions will automatically start in Auto Mode; those who have set other defaults will see a one-time prompt; if a Team admin has already specified a default in managed settings, they are unaffected.
Switch modes in the CLI by pressing Shift+Tab, or use the mode dropdown menu in the desktop app. Admins can use `defaultMode` in managed settings to set an organization-wide default, or use `disableAutoMode` to completely turn off Auto Mode.
Anthropic concludes the announcement by noting that Auto Mode relies on a classification system, which can reduce risk but not eliminate it. For high-risk changes to production infrastructure, users are still advised to review Claude's actions themselves.
Reference link: [1]https://claude.com/blog/auto-mode-default-in-claude-code
This article is from WeChat Official Account "QbitAI", Author: Follow Cutting-edge Technology
