Anthropic made Auto Mode the default in Claude Code on August 14 for Pro, Max, and Team plans, and it comes with hard coded fallback thresholds that determine when the assistant stops asking for permission and when it silently reverts to asking for every action again.
Since August 14, new Claude Code sessions on Pro, Max, and Team plans launch in Auto Mode by default rather than the older behavior of prompting for permission before every tool call. Auto Mode routes each action through a safety classifier that approves or blocks it automatically, and Anthropic has stopped charging Pro, Max, and Team users for the extra compute that classifier requires, so there is no cost reason left to turn it off.
The detail most teams miss is the fallback behavior. If the classifier blocks an action three times in a row, or twenty times within a single session, Claude Code automatically drops back into manual approval mode rather than continuing to silently deny requests. That threshold is not configurable in the current release, and it is not surfaced anywhere in the terminal prompt when it triggers, so a session that suddenly starts asking for permission again after a string of blocked actions is not a bug, it is the safety fallback doing its job.
Three protections sit underneath the classifier regardless of how the fallback behaves. Data exfiltration actions cannot be approved under any circumstance, even if a user explicitly requests it. Git safety checks confirm a repository's visibility and status before Claude Code will run a destructive git operation. And any external content pulled into a session, a fetched webpage, a file from an untrusted source, is screened for prompt injection attempts before the model is allowed to act on instructions found inside it.
Anthropic backed the rollout with a controlled study of 1,053 paid Claude Code testers: Auto Mode's classifier caught 89% of dangerous commands in testing, 937 out of 1,053, compared with 13.6%, or 143 out of 1,053, caught by human reviewers manually approving the same actions in the control group. For teams running Claude Code against production codebases, that gap is the practical argument for leaving Auto Mode on rather than reverting to manual approval by habit.
Try it today
- Confirm you are on a Pro, Max, or Team plan, since Auto Mode is not the default outside those tiers.
- If a session unexpectedly starts prompting for every action again, check whether you hit three consecutive blocks or twenty blocks in the session before assuming something broke.
- Do not rely on Auto Mode for workflows that require irreversible or externally aimed actions; the classifier hard denies data exfiltration regardless of how the request is phrased.
- Review git safety checks before running Auto Mode against a private repository you did not expect Claude Code to treat as sensitive.
- If your workflow pulls in external content, such as fetched web pages, expect the prompt injection screen to occasionally block legitimate actions that resemble an injection pattern; that is a false positive worth reporting, not a permissions bug.