Claude Code Auto Mode Explained: What Changed (and How to Stay Safe) in 2026

- The numbers, version gates, and classifier behavior below were cross-checked directly against the official code.claude.com docs at the time of writing (2026-08-20); this surface changes with every release, so verify the live docs before you depend on anything here.

What changed on August 14, 2026

If Claude Code recently stopped asking "may I do this" before every file edit or shell command, here's why: as of August 14, 2026, auto mode became the built-in starting permission mode on Pro, Max, and Team plans - not a feature you opt into, but one that's already on for you. The switch requires Claude Code v2.1.228 or later on macOS, Linux, and WSL, or v2.1.233 or later on native Windows (not through WSL); older versions still start in Manual mode as before.

One thing easy to miss: this is not a site-wide switch. Enterprise, sessions running on a Claude Console API key, claude -p/Agent SDK, and sessions on Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry still start in default (Manual) as before - the change only touches terminal and VS Code sessions on the three consumer/team plans.

What auto mode actually is

The short, official definition: auto mode is a permission mode where a second model, the classifier, reviews actions instead of you, rather than you clicking through y/n prompts one at a time. The classifier blocks anything that escalates beyond your request, targets infrastructure it doesn't recognize as trusted, or looks driven by hostile content Claude just read.

One detail most sources skip: an explicit ask rule in settings.json still forces a prompt, even in auto mode - because an ask rule is you already declaring "I want to be asked here." And auto mode isn't the only place the classifier runs: plan mode also routes shell commands through it when auto mode is available (on by default via the useAutoModeDuringPlan setting) - the line between "plan" and "auto" is thinner than most people assume.

The classifier's four rule tiers: hard_deny, soft_deny, allow, and user intent

This is the part most sources get wrong or skip entirely: inside the classifier, every action goes through exactly four precedence tiers, in a fixed order - each tier beats the one below it.

The three lists above (hard_deny/soft_deny/allow) are Anthropic's built-in rules, written as prose descriptions, not regex. Separate from them is autoMode.environment, where you declare which infrastructure - repos, buckets, internal domains - the classifier should treat as your "trusted boundary." By default the classifier trusts only your current working directory and that repo's configured remotes; everything else, including your own company's cloud buckets or internal domains, counts as "external" until you add it to environment. That's why a perfectly legitimate internal push sometimes still gets blocked: the classifier simply doesn't "know" that infrastructure is yours yet.

What auto mode blocks and allows by default

The full list is long (and version-gated item by item), but here's what matters most for a solo developer:

One detail easy to miss on the "allowed" side: pushing to the default branch (including main) is now allowed by default - before v2.1.211, only your own working branch and branches Claude created were allowed. Branches whose names look like deploy targets, such as production, release, or gh-pages, aren't covered by that default - the classifier judges a push there on its own terms, treating it like a production deploy. To tune this list further (adding trusted internal buckets/domains to environment, or tightening soft_deny), see /docs/en/auto-mode-config.

Is auto mode actually safer? The numbers

From Anthropic's controlled study of 1,053 paid testers: human reviewers caught only 13.6% of dangerous commands on their own; auto mode caught 89%. In real production data, 6.3% of manually approved sessions contained a harmful action the user hadn't explicitly asked for, compared to 2.4% of auto mode sessions (production-level severity, threshold 7+).

This is the pair of numbers independently corroborated across at least three sources, so it's safe to cite. Source: Anthropic's official post, auto-mode-default-in-claude-code (claude.com/blog, 08/2026). One caveat worth stating plainly: other secondary figures in that same post (like average per-session approval rates) returned slightly different numbers across different fetches while researching this piece - so this article only cites the well-corroborated pair above, and you should treat any "X% safer" claim as a trend, not a guarantee for your specific session.

Why the classifier resists prompt injection - it never reads tool results

A question most competitors gloss over: if Claude reads a malicious file (a dependency's README, a GitHub issue with hidden instructions), can it trick the classifier too? Per the official docs: the classifier only sees your messages, the tool calls Claude makes, and your CLAUDE.md content - it never sees a tool's result. Hostile content sitting inside a file or web page Claude just read cannot directly manipulate the classifier's decision.

This layer is backed by a separate server-side probe that scans incoming tool results and flags suspicious content before Claude reads it. To be clear: this is partial defense, not an absolute guarantee - Anthropic's own warning states that auto mode "reduces permission prompts but does not guarantee safety."

The claude auto-mode CLI commands

Want to add your own rules while keeping the defaults? Include the literal string "$defaults" in the array - the built-in rules are spliced in at that position, and yours can go before or after. Omitting "$defaults" means you replace the entire default list for that section - including the rules that block force push or data exfiltration - so only do that when you genuinely intend to own the whole list yourself. Pair this with Claude Code's Bash sandbox for an isolation layer independent of the classifier.

Reviewing and retrying a blocked action - the "Recently denied" tab

When the classifier blocks an action, Claude Code shows a notification and logs it under /permissions, in the Recently denied tab. Open that tab and press r on a denied action to mark it for retry - when you exit the dialog, Claude Code tells the model it may retry that tool call and resumes the conversation.

There's a worthwhile automatic fallback: if the classifier blocks an action 3 times in a row or 20 times total in one session, auto mode pauses itself and Claude Code resumes prompting manually. This threshold isn't configurable. Approving any action resets the consecutive counter, while the total counter persists for the whole session until it triggers the fallback on its own. The most common cause of repeated blocks is the classifier missing context about your infrastructure - the fastest fix is adding the destination (domain, bucket, repo host) to autoMode.environment, then running claude auto-mode config to confirm it took.

How to switch back to Manual (or any other mode)

The fastest way is still Shift+Tab. Worth getting exact: the default cycle runs default → acceptEdits → plan → auto → back to default. Standing in auto, one press takes you straight back to default (Manual) - because auto is the last stop before the cycle loops around.

Three other ways:

• A startup flag: claude --permission-mode default
• A pinned setting via defaultMode in settings.json - the value "auto" specifically only takes effect when declared in ~/.claude/settings.json (the user-scoped file); setting it in a project's .claude/settings.json is ignored, the same guardrail that stops a cloned repo from granting itself elevated permissions
• An org-wide off switch: an admin sets permissions.disableAutoMode to "disable" in managed settings - this removes auto from the Shift+Tab cycle entirely

For the full picture on all six permission modes and configuring allow/deny rules, see Claude Code permissions and safe configuration.

A practical safety checklist for auto mode

• Confirm your plan and model actually support auto mode (Opus 4.6+/Sonnet 4.6+/Fable 5 on the Anthropic API; Sonnet 5/Opus 4.7+/Fable 5 on Bedrock/Vertex/Foundry) - older models like Sonnet 4.5, Opus 4.5, and Haiku aren't supported on any provider.
• Before a task that touches significant infrastructure, review the trust list in autoMode.environment with claude auto-mode config - don't let the classifier guess what's trustworthy.
• Want a human checkpoint before a push or PR? Add a permissions.ask rule (e.g. "Bash(git push *)") - it always wins; the classifier can't auto-approve past it.
• Don't treat auto mode as a substitute for a sandbox on genuinely unattended runs - a container or VM adds an isolation layer that doesn't depend on the classifier alone.
• Check /permissions → Recently denied periodically instead of dismissing the block notification - it's usually a sign the classifier lacks context, not that it's wrong.
• Boundaries stated in conversation ("don't push," "wait for my review before deploying") are honored by the classifier as a block signal - but can be lost when context gets compacted. For a boundary that must hold, use permissions.deny or permissions.ask instead of only saying it in chat.

Auto mode and AgentKit skills

The honest question: do AgentKit's skills get around the classifier's oversight? No. AgentKit's skills are SKILL.md files that run through Claude Code's own native skill system - they don't add a separate permission layer, and they don't bypass the classifier. Under auto mode, a skill's actions get reviewed by the classifier exactly the same way any command you type yourself does.

To avoid overclaiming: this is not "AgentKit is safer than auto mode" - there's no basis for that claim, and making it would be dishonest. AgentKit's real value is elsewhere: it gives you ready-made workflows (skills, agents, review gates) instead of writing one-off scripts yourself, but everything still runs under the exact same governance this article just described - nothing more, nothing less. AgentKit is a paid add-on that runs inside Claude Code (and Codex); Claude Code itself is already free or included in the plan you're paying for. For a full breakdown, read what AgentKit is and whether it's worth it.

Frequently asked questions (FAQ)

Is Claude Code auto mode safe?

Safer than manual review by the controlled-study numbers (89% vs. 13.6% of dangerous commands caught), but not an absolute guarantee. Anthropic's own docs state plainly that auto mode reduces permission prompts without guaranteeing safety - a checklist and human checkpoints still matter for genuinely sensitive work.

How do I turn auto mode off?

Press Shift+Tab to return to default (Manual) mid-session, or set defaultMode in ~/.claude/settings.json (it must be the user-scoped file, not a project one). At the organization level, an admin can disable it entirely via permissions.disableAutoMode: "disable" in managed settings.

Does auto mode cost more or use more tokens?

On Pro/Max/Team plans, there's no extra charge for the classifier's overhead. On Enterprise, and on accounts using the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry, classifier calls DO count toward your token usage - a distinction worth knowing before rolling auto mode out to a team (verify-live: check current pricing policy at the time you read this).

Which models support auto mode?

On the Anthropic API and Claude Platform on AWS: Opus 4.6 or later, Sonnet 4.6 or later, or Fable 5. On Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, and Claude apps gateway sessions: only Sonnet 5, Opus 4.7 or later, and Fable 5. Older models - Sonnet 4.5, Opus 4.5, Haiku, and the claude-3 line - aren't supported on any provider.

Does auto mode stop prompt injection?

Partially, not completely. The classifier never reads tool results (where hostile content typically hides), which makes it hard to manipulate directly, plus a server-side probe scans tool results before Claude reads them. It's layered defense, not a guarantee of immunity.

Is Enterprise on auto mode by default?

No. Enterprise (along with sessions on a Claude Console API key, claude -p/Agent SDK, and the Bedrock/Vertex/Foundry providers) still starts in default (Manual). Auto mode is available but requires opting in via defaultMode or admin-managed settings, not enabled automatically like Pro/Max/Team.

Conclusion

Don't think of auto mode as "turn off all the warnings for speed" - it's a different layer of oversight, not the absence of one. Understand the four rule tiers (hard_deny/soft_deny/allow/user intent), know where to review blocked actions (/permissions → Recently denied), and keep the same old principle: a boundary that must hold belongs in config (deny/ask), not in a spoken note that can disappear on compaction. For the full picture on all six permission modes, read Claude Code permissions and safe configuration; to understand Claude Code from the ground up, see what Claude Code is.