Products#Coding agent#AI safety
Claude apps make auto mode the default next week, but the 89% figure is Claude Code only
Anthropic said October 22 that most Claude apps default to auto mode next week on Pro, Max and Team; its 89% block rate covers Claude Code only.
Anthropic appended an update on October 22 to a blog post first published August 7: starting next week, auto mode becomes the default for new sessions in “most Claude apps” on Pro, Max and Team plans. Auto mode is the permission model Anthropic began testing in Claude Code in March, replacing per-action approval with one automated check that lets safe actions run, blocks risky ones, and sends Claude looking for another route. The same post states that all the data it reports was gathered on Claude Code.
Key points
- Timing and scope: announced October 22, effective next week. The post says “most Claude apps” and never enumerates web, desktop or mobile. New sessions default to auto mode on Pro, Max and Team, users can switch back to manual at any time, and Enterprise admins get an email before the default changes for their organization.
- The headline pair: among 1,053 paid testers, human review caught 143 dangerous commands (13.6%) and auto mode caught 937 (89%). The post scopes both numbers to Claude Code, so they do not carry over to the apps.
- The missing cell: the post reports a miss rate (12% down to 7% after Apollo Research’s hardening), and harm rates in production traffic (6.3% manually approved vs 2.4% in auto mode at severity 7 and above). It publishes no false-positive rate at all.
What changes
Making auto mode the default moves where a new session starts. Where Claude once asked before each tool call, an automated check now reviews the action first: safe ones proceed, risky ones are blocked and Claude retries on another path. Users who want per-action approval back can switch to manual.
The Claude Code controls are documented. Press Shift+Tab in the CLI, or use the mode dropdown in the desktop app; admins set an organization-wide default with defaultMode in managed settings, or turn auto mode off with disableAutoMode. Anthropic describes those two entry points inside the Claude Code section and does not say which control the apps use.
A safety valve comes with a specific threshold: after three blocks in a row, or twenty across one session, Claude Code hands control back to the user. That rule is also written for Claude Code, and the post does not say whether the apps carry the same threshold.
Enterprise is not in this wave. The post says Enterprise admins will get an email before auto mode becomes their default. On Claude Enterprise, the Claude API, Claude Platform on AWS, Amazon Bedrock, Google Cloud’s Agent Platform and Microsoft Foundry, auto mode stays opt-in for now, with a default planned “in the coming month”.
The company’s own wording is not uniform. Anthropic’s X account posted on October 22 that the change covers “sessions across Claude web, desktop, and mobile apps”, which is more specific than the blog’s “most Claude apps”. Both describe the same rollout. The post never enumerates the three surfaces, so the post’s wording is the one to quote.
Background
Auto mode predates October. TechCrunch’s Anthony Ha reported on August 9 that Anthropic shipped a test version in March, then made it the Claude Code default for Pro, Max and Team starting August 14. The classifier adds a few tokens per tool call, and Anthropic stopped charging those three tiers for the overhead on August 7.
Approval fatigue is the measured reason for the switch. Anthropic says Claude Code users approve 97% of permission prompts; the rejection rate for individual requests is 3%, while plan approvals are rejected 39% of the time. As of June 2026, 49.5% of active CLI users had written a Bash allow-rule, 5% allowed any shell command, and 43% had interpreter rules such as Bash(python:*) or Bash(node:*). Another 62% had used bypassPermissions or clicked “don’t ask again” on Bash, and 25% of interactive sessions opened in bypass mode.
That design runs opposite to Claude Duet, which enumerates the action types that always need approval and keeps a short list of things it will not do even with approval. One company now ships two opposite defaults, chosen by whether the work runs in front of you or in the cloud.
Where the numbers stop
The scoping sentence is the part most coverage will fumble. Immediately after the October 22 update, the post says: “The data in this article below is specifically for Claude Code.” That puts 89%, 13.6% and 97% inside Claude Code. Whether the apps reuse the same classifier is not stated, and Anthropic published no app-side test data.
The study design is worth reading closely. A research vendor recruited 1,053 paid professionals who worked in a test environment. They knew they were being evaluated but, following standard blind-study design, were not told which behavior was being measured; researchers swapped one permission prompt for a plainly dangerous command, and nothing dangerous ever ran. Head to head, auto mode blocked 800 commands a human approved while humans blocked only 6 that auto mode allowed. Human detection ran at about 17% early in a session and fell to about 5% after 50 or more prior prompts. Auto mode’s rate stayed flat as sessions lengthened.
| Metric | Human review | Auto mode |
|---|---|---|
| Dangerous commands caught (of 1,053) | 143, or 13.6% | 937, or 89% |
| Head-to-head | let through 800 that auto mode blocked | let through 6 that humans blocked |
| Detection early in a session | about 17% | not given; no decay with session length |
| Detection after 50 prompts | about 5% | unchanged |
| Harmful actions in production (severity 7+) | 6.3% | 2.4% |
| Miss rate on adversarial attacks (after hardening) | not tested | 12% down to 7% |
| False-positive rate | not published | not published |
False positives are absent entirely. The post gives no rate for safe actions blocked by mistake. Gusto’s number, “about 10% of sessions since mid-May include a classifier denial”, is a denial rate and not a false-positive rate; the two are different measurements.
Apollo Research ran the external hardening: a two-week pilot injecting synthetic attacks into real coding trajectories across three datasets. After hardening, auto mode caught about half of the attacks it previously missed while newly missing about 2% it previously caught; across shared and held-out sets the miss rate fell from 12% to 7%. Trajectory Labs tested indirect prompt injection across 72 scenarios run ten times each, 720 attempts total, on Claude Code v2.1.205 and Codex v0.144.5 as of July 17, 2026. No attack got through against Claude Fable 5, Opus 5 or Sonnet 5 in auto mode. GPT-5.6 Sol succeeded 5.83% of the time in Codex auto-review and 19.03% in full access. That kind of external probing showed up elsewhere this month too: METR and Redwood found several ways to blind OpenAI’s internal agent monitor (our October 22 report).
What others say
The August rollout drew wide coverage: The Register, InfoWorld, Mashable and Inc.com were among the outlets that wrote it up. The October expansion to the apps has no second newsroom behind it. We checked Google News for both windows: dozens of items in August, three in October, and all three were about Claude Duet, Claude inside Gemini and a Sonnet 5.5 price change rather than auto mode. So August was widely reported and this week’s step was not.
TechCrunch’s Anthony Ha (August 9) largely followed the official framing: the August 14 date, 89% versus 13.6%, the 97% approval rate, plus a quote from Claude Code lead Boris Cherny, “I couldn’t imagine going back to permission prompts!” He raised no concern about the study design and did not mention false positives.
The New Stack’s Frederic Lardinois (August 7) supplied the sharpest reservation: auto mode “is a classifier, not a guarantee — it reduces risk, it doesn’t eliminate it,” and for production infrastructure Anthropic still recommends keeping a human in the loop. He noted the evaluation was vendor-commissioned and disclosed that TNS owner Insight Partners invests in both OpenAI and Anthropic. The post states that comparison itself: 19.03% in full access and 5.83% in auto-review. Lardinois restates it as 19% and “just under 6%”.
Both writers noticed the 89% against 13.6% contrast. Neither asked whether the apps would run the same classifier, a question that only became load-bearing after October 22.
Our take
For anyone handing Claude long tasks, this changes the starting state of a session. Capability is the same; you stop being asked one action at a time. What is left to decide is which operations must stay manual. Three categories are worth pinning regardless of the default: writes to production systems, credential reads, and anything that sends data outside your environment.
The bigger unknown sits on the app side. The 89% came from command-line work in Claude Code; a Claude app session spans a whole conversation, file uploads and connector calls, which is a different attack surface. Anthropic has not said the apps reuse the classifier, and published no app-side false-positive rate. Teams planning unattended work in the apps can test it themselves once it lands: run a few known-dangerous commands and a few ordinary large-file operations, watch what gets blocked and what slips through, then decide which permissions to hand over.
For admins, the email only announces a default change. defaultMode and disableAutoMode live in managed settings, so set the organizational default first and wait for app-side classifier documentation before loosening it. Anthropic published the Claude Code team’s seven-layer review process on October 15 (our report); that process reviews code, while auto mode governs permission before execution. They sit at different points in the pipeline.