source: Simon Willison: Auto mode is now the default in Claude Code for Pro, Max, and Team plans
level: technical
Anthropic will make auto mode the default in Claude Code for Pro, Max, and Team plans starting August 14. The change reflects confidence in the feature’s safety, which was discussed at the AI Engineer World’s Fair. Anthropic staff said almost everyone internally uses auto mode, and the company published evaluations to support the decision. The move aims to reduce the burden of manual permission approvals during coding sessions.
In a test with 1,053 paid users, a dangerous command was swapped into a permission prompt. Only 13.6 percent of humans refused the harmful action, while auto mode blocked 89 percent of those cases. A separate third-party evaluation by Trajectory Labs tested 72 indirect prompt injection scenarios across 720 attempts. None succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode, according to Anthropic.
Despite the strong results, 11 percent of harmful actions still slipped past auto mode in the human test. Simon Willison notes that prompt injection remains a serious concern, especially attacks hidden in third-party packages. He questions whether auto mode can detect a malicious package that instructs fetching model files via another harmful package. Willison advocates for running agents with minimal access to sensitive data or tools to limit potential damage.
why it matters: Auto mode reduces confirmation fatigue but still leaves a gap in blocking harmful actions, so developers must remain cautious about prompt injection and limit agent access to sensitive resources.
source: Simon Willison: Auto mode is now the default in Claude Code for Pro, Max, and Team plans