Auto Mode Will Become the Default in Claude Code

Anthropic is so confident in the so-called auto mode for Claude Code that, starting August 14, it is making it the default setting for new sessions on most plans — Pro, Max and Team. This is the mode in which the agent doesn't beg the user for confirmation on every action, but decides for itself what it can run.

Simon Willison, who flagged the news, recalls a conversation with Cat Wu and Tarek Sheehipar at the AI Engineer World's Fair conference. Asked how Anthropic itself safely runs Claude Code given the threat of prompt injection, he was told that “inside the company, practically everyone uses auto mode.” According to Wu, the main risks — the injection of malicious instructions and data leakage — are “far lower with the automatic mode than with the average human reviewer.”

What the Tests Showed

To back this up, Anthropic published its evals. One experiment involved 1,053 paying testers: midway through a session, a routine confirmation request was swapped for a plainly dangerous command, and the researchers recorded whether the human would approve it. Only 13.6% of the subjects declined. Auto mode, by the company's calculations, would have blocked 89% of such actions. Willison notes soberly: that still leaves 11% of cases in which the automation would not have stopped a dangerous action.

Resistance to prompt injection was tested separately. The independent Trajectory Labs tested the versions of Claude Code and Codex current as of July 17, 2026 against 72 indirect instruction-injection scenarios. Not one of the 720 attack attempts succeeded against the Claude Fable 5, Opus 5 and Sonnet 5 models running in auto mode. Sheehipar joked on social media that the post should have been titled “A Victory Over the Lethal Trifecta.”

The Skepticism Remains

Willison readily agrees that automatic mode is better than endless confirmation prompts: “OK”-button fatigue is real and does not lead to safe behavior. But he distinguishes between two threats. The first is accidental destructive actions, such as deleting the wrong files or wiping a production database. The second, which worries him more, is precisely prompt injection, where malicious commands are hidden in the external content the agent reads.

The author recalls his own prediction of a “Challenger-level catastrophe” for the security of coding agents in 2026, and admits he would be glad to be wrong. Still, he'd like to see more independent confirmation. As an example he cites a malicious package that, under the guise of instructions for running tests, first proposes to “fetch the model files” via another, already malicious package that quietly siphons off all available data. How auto mode would protect against this is unclear to Willison — and he leans toward the idea of simply not giving agents access to data and tools capable of doing harm.

Source: Simon Willison