Starting August 14, new Claude Code sessions on Pro, Max and Team plans will run in auto mode by default. Users who have already selected or pinned another permission mode may retain it, while Enterprise and cloud-platform deployments remain opt-in for now.
Instead of asking the developer to approve every file change or terminal command, auto mode sends tool calls through a classifier that evaluates whether they appear destructive, irreversible or directed outside the working environment.
This addresses a weakness in manual supervision. According to Anthropic’s announcement, users approve 97% of Claude Code’s permission prompts. In a controlled study involving 1,053 paid testers, the company says auto mode detected 89% of harmful actions, compared with 13.6% detected through manual review.
The announcement provides limited methodological detail, so the figures are best read as vendor-reported evidence rather than an independent benchmark. They still support a narrower conclusion: asking developers to approve every routine action can produce considerable interaction without a corresponding level of scrutiny.
Auto mode may make better contextual decisions than a user clicking through repeated prompts, but the remaining question is which decisions should depend on contextual judgment in the first place.
What auto mode decides
Claude Code’s auto mode combines two model-based controls. An input probe examines content entering the agent’s context, such as files, web pages and tool results, for possible prompt injection. A separate classifier evaluates proposed tool calls before execution.
If the classifier blocks an action, Claude Code may find another way to proceed or ask the user for approval. Repeated blocks return the session to manual approval, while explicit permission rules continue to apply throughout the process.
This allows the system to consider context that a static rule may lack. The classifier is therefore evaluating whether an action appears consistent with the user’s intention. That differs from establishing the maximum authority available to the agent.
Anthropic makes this distinction in its own security guidance. Its engineering team describes model-based controls as probabilistic and recommends using auto mode inside an isolated environment. A classifier can influence what an agent is likely to do, while a sandbox, filesystem policy or credential boundary determines what it is capable of doing.
Untrusted data can influence trusted actions
Coding agents also read repositories, issue descriptions, pull requests, dependency documentation, test output and responses from connected tools. Instructions embedded inside this operational data can influence the agent after entering its context, potentially redirecting subsequent actions.
The AgentDojo benchmark, developed by researchers from ETH Zurich and Invariant Labs, evaluated indirect prompt injection across 97 realistic tasks and 629 security cases. Its scenarios did not involve Claude Code, but they demonstrate the broader mechanism: data returned by an external tool can contain instructions that redirect an agent towards an unauthorized action.
OWASP describes the related permission failure as excessive agency. Its recommendations include limiting the tools and permissions available to an agent, requiring confirmation for high-impact operations and enforcing authorization in downstream systems.
The final point is important. A database, cloud platform or external API should still verify whether an operation is authorized. The agent’s interpretation of the task should not replace the destination system’s access policy.
A sandbox does not cover every trust boundary
Environmental containment provides a stronger limit than behavioural classification, although the surrounding developer tooling also has to be included in the threat model.
In July, the Cloud Security Alliance analyzed seven vulnerabilities disclosed across Cursor, Codex CLI, Gemini CLI and Google Antigravity. The findings did not test Claude Code or its auto mode. They illustrate a separate problem involving the boundary between an agent-controlled workspace and trusted software outside it.
In several cases, the agent remained inside the sandbox and wrote to an allowed location. A host-level component later consumed what it had written. Examples included hook configurations, virtual-environment interpreters, Git configuration and task definitions. The agent did not have to escape the sandbox directly because another process gave its output greater authority after execution ended.
This “trust handoff” complicates the distinction between a safe workspace and the rest of the machine. A file can remain inside the repository while influencing an IDE extension, Git subsystem, task runner or interpreter operating with the developer’s privileges.
Teams therefore need to examine both what the agent can execute directly and which agent-written artifacts other software may later load or run.
Five questions for the permission model
One practical way to review a coding agent’s permission model is to separate five related questions:
| Area | Question | Relevant controls |
| Intent | Does the action fit the requested task? | Auto-mode classifier |
| Capability | Is this category of operation permitted? | Allow, ask and deny rules |
| Reach | Which files, processes and destinations are accessible? | Sandbox and network policy |
| Authority | What can the agent do in an external system? | Scoped identity, credentials and API permissions |
| Handoff | Can an agent-written artifact influence a more privileged process? | Protected paths and configuration validation |
These areas overlap. A sandbox can restrict capabilities as well as reach, while credential scope affects both authority and accessible resources. The value of separating them lies in preventing the classifier from becoming the only control considered.
Claude Code evaluates explicit deny rules before ask and allow rules. Teams can prevent access to credential paths, production tooling or particular command families regardless of the classifier’s decision. Sensitive operations that remain legitimate in some circumstances can require confirmation, while routine activity inside the repository can continue without repeated prompts
Credentials require their own boundary. NVIDIA’s security guidance recommends starting agent sandboxes with an empty or minimal credential set, removing secrets unrelated to the task and using short-lived, task-specific credentials where possible.
The objective is to limit the consequences of a mistaken approval, compromised context or containment failure.
Subagents extend the parent’s authority
Claude Code can delegate work to built-in and custom subagents. When the parent uses auto mode, its subagents inherit that permission mode, and a different mode declared in their own frontmatter is ignored. Built-in and MCP tools may also be inherited, subject to Claude Code’s foreground, background and tool-set filters.
This makes the assigned role an insufficient security control. Calling a subagent a “code researcher” describes its purpose, while its available tools determine its effective authority. A research subagent may only require reading and search. A testing subagent may need command execution inside an isolated worktree. Permissions should follow the delegated task rather than the capabilities of the parent session.
Human judgment moves earlier
Anthropic’s evidence suggests that automatic classification can provide more effective supervision than habitual approval prompts.
For teams adopting auto mode, the important decisions happen earlier: which tools the agent receives, which files it can change, which destinations it can reach, which credentials enter its environment and which host processes will trust its output.
