Auto Mode becomes default in Claude Code for Pro, Max, and Team plans

Anthropic is confident in Claude Code's auto mode, making it the default for new sessions in Pro, Max, and Team plans starting August 14, 2026. During a Fireside Chat at the AI Engineer World’s Fair, Cat Wu and Thariq Shihipar discussed how Anthropic runs Claude Code safely, noting that almost everyone internally uses auto mode and that they have mitigated major risks like prompt injection and data exfiltration. Anthropic published evals from a test with 1,053 paid testers where a dangerous command was swapped into a session; only 13.6% of humans refused, while auto mode would have blocked 89% of those actions. Anthropic also commissioned an evaluation from Trajectory Labs, which tested 72 indirect prompt injection scenarios against Claude Code and Codex, finding zero successful attacks against Claude Fable 5, Opus 5, or Sonnet 5 in auto mode. The author, Simon Willison, acknowledges auto mode may be better than human approval due to confirmation fatigue, but he worries about indirect prompt injection via malicious packages, such as a test instruction that runs a malicious tool to exfiltrate data. He calls for independent confirmation and suggests running agents with restricted data and tools access.