Claude auto mode becomes the default in the Claude apps: what the check blocks and what 89% measured

On October 22 the Claude account announced that the apps will follow the terminal, where new Claude Code sessions on Pro, Max and Team have started in auto mode since August 14:

Starting next week, sessions across Claude web, desktop, and mobile apps will run
in auto mode by default on Pro, Max, and Team plans. Rather than asking you to
approve each step, an automated check blocks risky actions. Switch back to manual
anytime.

It quotes the August headline too: in testing, auto mode “caught 89% of dangerous commands. Manual approval caught 14%.” The number is real, and it measures the case a classifier is built for, one obviously dangerous command dropped into a long session. Read the other way, 116 of those commands got past the check. For a command written to get past it, nobody has published a real-traffic number.

What changes in the Claude apps when auto mode becomes the default?

New sessions in “most Claude apps” on Pro, Max and Team start in auto mode instead of asking before each shell command or network request. That phrase is from Anthropic’s October 22 update, which gives no product-by-product schedule or exact day. On Enterprise, admins get an email before the default changes.

The docs show the Auto switch in Claude Code sessions in the desktop app’s Code tab, on claude.ai/code and in the mobile app. On desktop, a mode you pick in the selector is remembered per folder and wins over the default, and Anthropic says that if you have a pinned default, nothing changes for you. Cowork has its own approval modes; with the new Claude experience its help page already lists Auto as the default on Pro, Max and Team. What Cowork’s sandbox reaches is the more useful question there.

What does the Claude auto mode check block?

It is built to block actions that are irreversible, destructive or aimed outside your environment. The default list includes production deploys and migrations, force pushes, curl | bash, terraform destroy, sending sensitive data to outside endpoints, printing a live credential, and interactive shells into a sensitive remote target.

Your own allow, ask and deny rules resolve first, ordinary reads and edits in the working directory skip the check, and most of the rest goes to a separate model, in the order the setup walkthrough describes. When it blocks, Anthropic says Claude “usually finds a safer way to proceed on its own.” After 3 blocks in a row or 20 in a session, auto mode pauses and asks you again.

Replies and Reddit threads describe deploy, docker and remote-shell commands being denied, then Claude trying another route. That rerouting is documented behavior. When the classifier simply does not know your infrastructure, the docs’ answer is to describe it in autoMode.environment.

What did Anthropic’s 89% vs 14% auto mode study measure?

It measured how often one clearly dangerous command slipped through. Anthropic hired 1,053 paid testers for a coding study in a test environment. Partway through each session, one permission prompt was swapped for a clearly dangerous command; nothing ran. Humans blocked it 143 times (13.6%), auto mode 937 times (89%). Head to head, auto mode blocked 800 commands a human approved; humans blocked 6 that auto mode allowed.

Humans also faded, from about 17% early in a session to about 5% after 50 prompts. That curve is the reflex I described in August, now with Anthropic’s own numbers on it. The same page puts the approval rate on Claude Code permission prompts at 97%, up from the 93% I quoted then.

Anthropic also says the data in that article is specifically for Claude Code. Two numbers are missing. There is no false-positive rate: one customer reports a denial in about 10% of sessions, which counts denials, not mistaken ones. And there is no miss rate on real traffic.

Is Claude auto mode safer than manual approval?

Against an obvious mistake, yes, by a wide margin. Against a command crafted to pass, the evidence gets thin fast. The attacker-side tests are synthetic. Apollo Research’s red-team set ended at a 7% miss rate, across shared and held-out cases, after hardening, and Anthropic prints the limit itself:

The 7% miss rate is measured against this set and should not be taken as the
miss rate on real traffic.

A separate prompt-injection evaluation found no successful attack in 720 attempts on each tested Claude model, through a test wrapper. Both are useful, and neither measures someone who keeps rewording a command against your setup. The argument from my earlier essay is about that case. A tired human is unreliable but noisy; a classifier is a consistent judge, so a wording that gets past it can be searched for. Auto mode beats clicking “allow” forty times. It does not replace a sandbox for what you cannot undo.

Does Claude auto mode count toward your usage limits?

The classifier overhead does not, on Pro, Max or Team. Anthropic stopped charging those plans for it on August 7, and the docs say classifier calls count toward token usage only on Enterprise and on the API and cloud providers. Where the server reviews actions inside the session’s own model requests, there are no separate calls. A Reddit thread says auto mode drains weekly limits faster; that is unverified, and a session that never stops to ask also simply does more work.

How do you switch Claude auto mode off in the apps?

Use the mode selector under the prompt box. On desktop, pick Manual; the choice sticks for that folder. On claude.ai/code, use the dropdown next to the prompt box. Cloud sessions have no Manual: they offer Accept edits, Plan and Auto, and Accept edits stands in for Manual because cloud sessions pre-approve file edits. Plan explores without editing your source. In the mobile app, tap + in the prompt box, then Permission.

To set a user-level default for new local sessions, put permissions.defaultMode in ~/.claude/settings.json. A per-folder pick still overrides it, and an auto value in a project’s .claude/settings.json or .claude/settings.local.json does not take effect.

{
  "permissions": {
    "defaultMode": "default"
  }
}

Team and Enterprise admins can remove auto mode with permissions.disableAutoMode set to "disable" in managed settings.

My advice for the first week: leave auto on where nothing reaches production, read what it blocks (in the terminal, the Recently denied tab in /permissions lists it), and move the few actions you never want run into deny rules. Those resolve before the classifier is asked. They match command text, so they are a floor, not a proof.