Anthropic's AI Coding Assistant Will Soon Act on Its Own — Without Asking First
Starting August 14, Anthropic will turn on "auto mode" by default for certain paying users of Claude Code, its AI coding assistant. With auto mode, the tool will take actions on its own, like editing files or running commands, without pausing to ask the user for approval each time. It will only stop and ask when it detects something that could be destructive, irreversible, or aimed outside the user's own system. Enterprise customers and those using Anthropic's API, which lets developers build Claude into their own apps, are not affected. Auto mode stays optional for both. The New Stack
Normally, Claude Code starts in a read-only state, meaning it can look at your code but not change anything until you say yes. Auto mode removes that step. Anthropic's decision is based on user behavior data: the company reports that users approve 97% of the prompts asking them for permission, attributing this to what it calls the reality that "manual review can become habitual." In other words, people get used to clicking "yes" without really reading what they are approving. TechCrunch
The company also ran a study with 1,053 paid testers comparing auto mode's automated safety checks against human review. Auto mode caught 89% of harmful actions; human review caught 13.6%. The gap is wide enough to challenge the common assumption that having humans approve each step makes things safer. The data suggests that for routine, high-volume approval decisions, the opposite may be true: a trained safety system outperforms a person who has learned to click "yes." TechCrunch
Claude Code Head Boris Cherny said on X that his team has used auto mode exclusively for many months and he could not imagine going back to permission prompts. TechCrunch
Anthropic first unveiled a test version of auto mode in March 2026, describing it as a way to balance speed and control. Since then, the company has been adding safety features alongside the autonomy push. These include screening for prompt injection, where someone tries to trick the AI with hidden instructions, and customizable rules that block specific actions outright, like transferring data outside the user's system. Claude Code also supports detailed permission settings that let users specify exactly what the agent can and cannot do, and a claude auto-mode reset command restores the original, more cautious configuration. TechCrunch
Under the hood, the safety system that decides which actions are safe runs on Claude Sonnet 5 by default when the user's settings allow that model. If Sonnet 5 is not available, it falls back to a different model. Claude Code also sends desktop notifications in certain terminal programs, like iTerm2 and Ghostty, when tasks finish or when it does need to ask for permission. A command-line flag lets users add their own instructions on top of the default behavior. Anthropic Docs
Anthropic introduced Claude Sonnet 5 on June 30, 2026, describing it as a major performance upgrade for coding, agents, and professional work at scale. Claude Opus 5 followed on July 24, 2026, described as a significant step forward for the Opus tier, which handles longer-running tasks with less human supervision. Both launches feed into the auto mode direction: the safety system benefits from Sonnet 5's improved capabilities, and Opus 5's focus on long-running tasks aligns with the goal of reducing how often a human needs to step in. Anthropic
The broader context here is something most computer users have experienced firsthand. Permission fatigue is a well-known problem in software design. It shows up everywhere: the pop-up asking if you really want to run this program, the firewall warning, the approval step before new software goes live. When people say yes to almost everything, the prompt stops working as a real safeguard and becomes just another click. Anthropic's data puts a number on that: a 97% approval rate means the manual checkpoint is, in practice, almost entirely decorative. Replacing it with an automated safety check that catches nearly nine in ten harmful actions, versus the roughly one in eight caught by habituated humans, is a reasonable tradeoff, provided the automated system's blind spots are well understood and the hard rules blocking dangerous actions are genuinely strict.
The decision to leave Enterprise users out of the default switch is worth noting. Large organizations have compliance rules, audit requirements, and shared infrastructure where an AI acting on its own and making irreversible changes carries a different level of risk than it does for a single developer on a personal plan. Anthropic's choice to keep auto mode optional for Enterprise and API users suggests an awareness that the safety math changes with scale and organizational context. Whether that line holds as the pressure to move faster intensifies is a question worth watching.
Anthropic has also been active on safety and governance beyond Claude Code. On June 30, 2026, the company proposed an industry-wide framework for scoring the severity of jailbreaks, which are attempts to bypass an AI's safety rules, together with Amazon, Microsoft, Google, and other Glasswing partners. On July 30, it announced it is investigating three real-world incidents in its cybersecurity evaluations. And on August 7, it published improvements to Fable 5's biology safeguards. Anthropic
For developers using Claude Code on Pro, Max, or Team plans, the practical shift on August 14 is straightforward: the assistant will stop asking before most actions and will step in only when it detects something it has been trained to flag. Detailed permission settings and hard blocking rules remain available for those who want tighter control. The claude auto-mode reset command offers a way back to the prior, more cautious default for anyone who finds the new behavior too permissive.
Anthropic's bet is that a well-trained automated safety system is a better gatekeeper than a human who has stopped reading the prompts. The 89% versus 13.6% data is hard to argue with on its own terms. What remains less certain is how that safety system handles the edge cases, the situations that do not fall neatly into the categories of "irreversible, destructive, or outside your environment," and how quickly Anthropic can close that gap as more developers rely on it.
