Claude Code switches to auto mode by default in 5 days, Anthropic covers extra costs

Anthropic will enable auto mode by default for all Claude Code installations in five days, after finding that only 3% of permission requests are rejected by users. The auto mode classifier consumes a small number of extra tokens per tool call, but Anthropic will not pass this cost to users. Cloud platforms such as Amazon, Google, and Microsoft, which currently offer auto mode as an option, must switch to default auto mode within one month. Anthropic's internal team already uses auto mode exclusively, according to the 'father of Claude Code.' Anthropic justifies the change with data: manual approval has become habitual, with a 97% acceptance rate for permission prompts, while the rejection rate for single permission requests is only 3%. In a controlled experiment with 1053 paid testers, human participants intercepted a clearly dangerous command 13.6% of the time, while auto mode intercepted it 89% of the time; auto mode blocked 800 commands that humans allowed, while humans blocked only 6 commands that auto mode allowed. Human performance decreased with session length, dropping from about 17% early on to about 5% after 50 prompts, whereas auto mode's interception rate remained constant. Production data re-scored on a severity scale from 0 to 10 showed that at severity 7 and above, 6.3% of manually approved sessions involved harmful actions not explicitly requested by the user, compared to 2.4% for auto mode. The classifier was adversarially tested with Apollo Research, which injected synthetic attacks into real coding traces; after hardening, auto mode recovered about half of previously missed attacks, with the miss rate dropping from 12% to 7% on combined datasets. In prompt injection tests by Trajectory Labs, Claude Fable 5, Opus 5, and Sonnet 5 running auto mode were not compromised in 720 attempts, while GPT-5.6 Sol in Codex Auto-review mode had a 5.83% success rate and 19.03% in Full Access mode. Three public interception cases include blocking a plan to publish a report on a public code-sharing site, blocking a bulk termination of processes across 2000 pods, and flagging a cloud role with full admin permissions. New capabilities include hard denial of data exfiltration, differentiation of key and sensitive information access, checking git status before commands like git reset --hard, and API-side probing for injection attempts. Users can switch modes with Shift+Tab in the CLI or the mode dropdown on desktop; administrators can set organization-wide defaults or disable auto mode entirely. Anthropic notes that auto mode reduces but does not eliminate risk, and recommends reviewing high-risk changes.