Auto mode is now the default in Claude Code
Points and comments are a snapshot, not live.
Auto mode, which routes tool calls through a safety classifier, becomes the default in Claude Code.
Anthropic is making auto mode the default in Claude Code for Pro, Max, and Team plans starting August 14. The classifier blocks irreversible or destructive actions, falling back to manual approval after three consecutive blocks or twenty total. Anthropic tested with 1,053 paid testers: humans caught 13.6% of dangerous commands, auto mode caught 89%. Internal analysis found serious unintended harm in 6.3% of manually approved sessions vs. 2.4% of auto mode sessions. Third-party evaluation found 0% of 720 prompt injection attacks succeeded against Claude Fable 5, Opus 5, or Sonnet 5 in auto mode. Adobe, Nuro, Gusto, and Garner Health already run auto mode as default. Enterprise customers can opt in; classifier overhead is no longer charged.
What commenters are saying
Many commenters run agents with permissions fully bypassed in sandboxes, reporting no incidents. Several share tools for sandboxing Claude Code: Docker, Podman, devcontainers, bubblewrap-based flar, and a macOS sandbox app. A few note that explicit tool-level permissions are a poor substitute for proper sandboxing, and that auto mode’s real value is reducing prompt fatigue. Skeptics argue relying on a classifier is fundamentally unsafe and prefer manual review or full sandbox isolation.