Tools · · 2 min read

Claude Code auto mode becomes the default on August 14 — and your Bash(python:*) allow-rule stops applying

Anthropic is flipping Claude Code to auto mode by default for Pro, Max, and Team on August 14, 2026. The headline number is 89% vs 13.6%. The line that actually changes your setup is buried mid-post: allow-rules broad enough to grant arbitrary code execution get set aside while auto mode is on.

Anthropic announced on August 7, 2026 that auto mode becomes the default permission mode in Claude Code on August 14. (Source: Anthropic, 2026-08-07)

Key facts:

  • New sessions on Pro, Max, and Team plans start in auto mode from August 14, 2026.
  • Auto mode stays opt-in for Claude Enterprise, the Claude API, AWS, Amazon Bedrock, Google Cloud’s Agent Platform, and Microsoft Foundry — Anthropic says it plans to flip those “in the coming month.”
  • Classifier overhead is no longer billed to Pro, Max, and Team users, effective August 7.
  • In a controlled study with 1,053 paid testers, humans caught 13.6% of a planted dangerous command; auto mode caught 89%.
  • Auto mode falls back to manual approvals after three consecutive blocks, or twenty blocks across a session.

The buried line that changes your config

Most coverage is leading with the 89% figure. The sentence that will actually change behavior on your machine is this one:

“Permission rules still fire before the classifier in auto mode, except for allow rules broad enough to grant arbitrary code execution (e.g. python:*). These arbitrary rules are set aside while in auto mode, since they would let commands skip the classifier entirely.”

Anthropic’s own telemetry says how many people that hits. As of June 2026, 49.5% of active CLI users had hand-written a Bash allow-rule. 5% allow any shell command outright. Another 43% have interpreter rules like Bash(python:*) or Bash(node:*) that Anthropic describes as “essentially equivalent in practice.” (Source: Anthropic, 2026-08-07)

If you are in that 43%, your settings file is not modified and your rule comes back the moment you switch modes — but from August 14, every python invocation in a default session goes through the classifier instead of your allow-rule. If you have been leaning on Bash(python:*) to keep a long batch job quiet, expect a different interruption profile, not zero interruptions.

The second thing to plan around is the fallback: three blocks in a row, or twenty across a session, drops you back to manual approvals. For an unattended overnight run or a CI-ish harness, that is a hang, not an error.

The safety numbers, and what they do not say

Bar chart: human review caught 13.6% of dangerous commands, auto mode caught 89%

Anthropic’s controlled study: 1,053 paid testers, one permission prompt per session swapped for a clearly dangerous command. Testers approved it 143 of 1,053 times; auto mode blocked 937 of 1,053. (Source: Anthropic, 2026-08-07)

Two details make the study more interesting than the headline. Head to head, auto mode blocked 800 commands a human approved, while humans blocked only 6 that auto mode allowed. And human performance decayed with session length — about 17% of dangerous commands blocked early in a session, dropping to about 5% after 50 or more prior prompts. The classifier’s block rate stayed flat.

On real traffic rather than a lab: among sessions Anthropic’s safety pipeline had already flagged (May–June 2026, opted-in accounts only), 6.3% of manually approved sessions contained a production-severity harmful action the user had not asked for, versus 2.4% of auto mode sessions.

Bar chart of prompt injection attack success rates by model and permission mode

Third-party evaluation by Trajectory Labs, 72 indirect prompt-injection scenarios × 10 attempts. None of the 720 attempts succeeded against Fable 5, Opus 5, or Sonnet 5 in auto mode. GPT-5.6 Sol in Codex Auto-review: 5.83%; in Full Access: 19.03%. (Source: Anthropic, 2026-08-07)

Read the footnote on that chart before you quote it. The attacks were optimized against Claude Opus 4.7, which is not in the reported set. The browser integration was a Trajectory Labs MCP wrapper, not OpenAI’s or Anthropic’s own Chrome extension, so first-party browser safeguards were not tested. Anthropic tested Claude Code v2.1.205 and Codex v0.144.5, and notes OpenAI shipped a new Auto-review version afterward. This is a real third-party eval, but it is not a like-for-like product comparison.

What this means if you are building with Claude Code

  • Before August 14, check ~/.claude/settings.json for interpreter allow-rules. If you rely on Bash(python:*) or similar, decide now whether you want auto mode or your rule — you cannot have both in the same session.
  • If you run Claude Code unattended, test the 3-in-a-row / 20-per-session fallback against your longest job before it bites you at 3am.
  • API and Enterprise users get a grace period, but not a long one. Anthropic says “in the coming month,” and it will notify Enterprise admins first.
  • To keep manual mode: press Shift+Tab in the CLI or use the desktop mode dropdown. Admins pin an org default with defaultMode in managed settings, or disable the feature entirely with disableAutoMode.
  • Anthropic’s own caveat is worth keeping: auto mode “relies on classification systems and therefore does not eliminate risk,” and it still recommends reviewing actions yourself for high-stakes production infrastructure changes.

Sources

Source: Anthropic