Anthropic is making auto mode the default across the Claude web, desktop and mobile apps. Starting next week, sessions on Pro, Max and Team plans will run in auto mode, the company said in an October 22 post from its Claude account. Rather than asking users to approve each step, an automated check blocks risky actions, and users can switch back to manual approval at any time.
The change carries over a default Anthropic already set in Claude Code, where new Pro, Max and Team sessions began running in auto mode on August 14. In the apps, users can return to manual approval from the session controls on web, desktop and mobile.
Auto mode sends every tool call through a classifier that looks for actions that are irreversible, destructive or aimed outside the user's environment. When it blocks an action, Claude usually finds a safer route or asks the user for approval. In Claude Code, the agent falls back to manual approvals if it is blocked three times in a row or 20 times in a session.
“We can see that auto mode blocks at the right time, which gives us the confidence to move quickly.”— Martin Emde, Software Engineer, Gusto
Key facts
- 01Claude web, desktop and mobile sessions will run in auto mode by default on Pro, Max and Team plans starting next week.
- 02An automated classifier blocks risky actions instead of asking users to approve each step; manual mode stays one switch away.
- 03Claude Code made auto mode the default for the same plans on August 14.
- 04In an Anthropic study of 1,053 paid testers, auto mode caught 89% of dangerous commands versus 13.6% for humans.
- 05Anthropic says Teams and Enterprise auto mode users ship about 25% more pull requests.
Other checks run alongside the classifier. Probes scan tool results for prompt injection, auto mode checks that actions match what the user asked for, and hard-deny rules block data exfiltration.
Anthropic's case for the switch rests on its own testing. In a controlled study with 1,053 paid testers, humans caught 13.6% of dangerous commands, while auto mode caught 89%. Auto mode blocked 800 commands that humans approved; humans blocked six that auto mode allowed.
The gap comes down to attention. Anthropic found users approve 97% of permission prompts, and human block rates fell from about 17% early in a session to about 5% after 50 or more prompts. The classifier's rate stayed flat.
Anthropic also had Apollo Research red-team the classifier. Its miss rate fell from 12% to 7% across shared and held-out attack sets, a figure Anthropic says applies to that adversarial set rather than real traffic.
Anthropic says auto mode users among its Teams and Enterprise adopters ship about 25% more pull requests.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
