Claude Code is automating approvals because humans stopped paying attention

Anthropic announced on August 7 that new Claude Code sessions on Pro, Max, and Team plans will run in auto mode by default from August 14. Users who have already chosen another default permission mode will keep it.

Enterprise and API users remain opt-in for now. Anthropic says it plans to make auto mode the default for them in the coming month, after notifying Enterprise administrators.

Auto mode does not remove command checks. It moves much of the decision from the developer to a classifier that evaluates a proposed command and can allow it, block it, or involve the user. Anthropic's argument is blunt: repeated permission prompts look like human oversight, but people become worse at reviewing them as a session gets longer.

That makes this more interesting than a settings change. Claude Code is replacing one imperfect reviewer with another. The practical question is whether the classifier can reduce dangerous approvals without becoming a new source of blocked deployments, opaque decisions, and workarounds.

Manual approval does not scale with agent sessions

Anthropic tested auto mode with 1,053 paid Claude Code users in a controlled environment. The company says its classifier caught 89% of dangerous commands, while participants manually reviewing prompts caught 13.6%. Human blocking reportedly fell from about 17% early in a session to about 5% after 50 or more prior prompts.

Those are Anthropic's results, not an independently validated comparison. The experiment also does not settle the everyday usability question. The announcement gives the classifier's detection rate for dangerous commands, but it does not disclose how often legitimate commands were blocked.

That missing false-positive rate matters. Anthropic says about 10% of Gusto sessions since mid-May include a classifier denial, but this is one customer's share of sessions containing any denial, not a false-positive rate. An automated reviewer that repeatedly rejects routine infrastructure work will push developers to switch modes, add broad exceptions, or stop treating its warnings seriously.

The community response shows both sides. An earlier Hacker News thread describes manual review as impractical when agents produce a large stream of commands. The official-announcement thread focuses more on sandboxing and whether a probabilistic classifier is the right boundary.

The r/ClaudeAI thread includes reports of auto mode blocking legitimate deployment work such as terraform apply, SSH access, and related commands. Commenters also flag the missing false-positive rate. These are individual experiences, not a measured failure rate, but they identify where the default will be tested first.

Anthropic also commissioned Trajectory Labs to run 72 indirect prompt-injection scenarios ten times each. The company reports that none of 720 attempts succeeded against Fable 5, Opus 5, or Sonnet 5 in Claude Code auto mode, while 5.83% succeeded against GPT-5.6 Sol in Codex Auto-review. This is useful evidence for auto mode's extra layer, but not a clean product ranking: the models differed, and the test used the same third-party browser wrapper rather than either product's complete safeguards.

Automated approval has its own operating cost

Claude Code is not alone in moving approval decisions to another model. OpenAI says Codex's “Approve for me” mode routes a request, together with relevant session context, to a separate subagent that decides whether to approve it. In an OpenAI Developer Community report, one user found codex-auto-review accounted for 74.6% of their locally logged usage. A separate Codex issue says approval calls failed after a five-hour usage limit was exhausted.

Those individual reports do not establish typical Codex usage, much less Claude Code's overhead. Anthropic says Pro, Max, and Team users are no longer charged for classifier tokens. They still illustrate a broader cost: model-based approval adds inference, latency, and accounting that tools should make visible.

The sandbox still has to carry the risk

Auto mode may be better than a dialog developers approve reflexively. It is not a substitute for limiting what the agent can reach. A coding agent with production credentials, broad network access, and an unrestricted shell can still do serious damage after a mistaken classification or a poorly specified request.

Teams adopting the new default should review Claude Code permissions alongside the surrounding environment: which directories are writable, which credentials enter the session, whether production deployment requires a separate gate, and which commands have been exempted after false positives. Version control helps recover code changes, but it does not recover leaked secrets or undo an infrastructure command.

The August 14 rollout is therefore a test of more than Anthropic's classifier. It will show whether automated review can remain useful once it encounters real repositories and deployment workflows, where blocking the wrong command can be almost as effective at training people to ignore safeguards as asking them to click Yes for the 50th time.