Anthropic Will Make Auto Mode the Default in Claude's Web, Desktop and Mobile Apps, Using Safety Data From Claude Code
Anthropic says auto mode will roll out next week as the default for new sessions in most Claude apps on Pro, Max and Team plans. An automated check will review each action instead of asking the user to approve it. Every safety figure Anthropic gives comes from testing in Claude Code, its coding agent, not from the apps; Enterprise admins will get an email before the switch.
Anthropic is moving its consumer and Team apps from asking before each action to letting a classifier decide, and the evidence it offers was gathered in a different product. In an October 22 update to its August post on Claude Code, Anthropic said auto mode "is rolling out next week as the default for new sessions in most Claude apps on Pro, Max, and Team plans."
What changes in the apps
Anthropic says that instead of asking users to approve each action, "an automated check reviews them: safe actions go ahead, and risky ones are blocked while Claude looks for another route." It says Enterprise admins will get an email before auto mode becomes the default for their organizations.
AiLookout.news, citing Anthropic's help center, reported that users can switch a session back to manual approval at any time, and that Claude still asks before permanently deleting files in every mode. It also reported that Team and Enterprise admins can turn auto mode off for members, or stop new tasks from starting in it, under Organization settings, and that the auto-start setting is off by default on Enterprise.
How auto mode works in Claude Code
Auto mode became the default in Claude Code on Pro, Max and Team plans on August 14. Anthropic says it routes each tool call through a classifier aimed at blocking actions that are "irreversible, destructive, or aimed outside your environment." If the classifier blocks three actions in a row, or twenty in a session, Claude Code falls back to manual approvals. Anthropic says data exfiltration sits in a "hard deny" category the classifier is designed never to approve.
The evidence Anthropic gives
Anthropic says all of the data in its post "is specifically for Claude Code." Its main figures:
- Permission prompts. Anthropic says Claude Code users approve 97% of permission prompts.
- Planted dangerous commands. In a study with 1,053 paid testers working in a test environment, Anthropic says humans caught a planted dangerous command 13.6% of the time (143 of 1,053), while auto mode blocked 89% (937 of 1,053).
- Real sessions. Re-grading flagged sessions from May to June 2026, Anthropic says 6.3% of manually approved sessions contained a production-level harmful action the user had not explicitly asked for, against 2.4% of auto mode sessions.
- Red-teaming. After a two-week pilot with Apollo Research, Anthropic says the classifier's miss rate on synthetic attacks fell from 12% to 7%. It says that rate "should not be taken as the miss rate on real traffic."
- Prompt injection. In an evaluation it commissioned from Trajectory Labs, Anthropic says none of 720 attack attempts succeeded against its models running auto mode, while 5.83% succeeded against OpenAI's GPT-5.6 Sol in Codex's Auto-review mode. Anthropic notes that OpenAI released a new version of Auto-review the week before its post, which could change the results.
Anthropic also says auto mode "relies on classification systems and therefore does not eliminate risk," and recommends reviewing Claude's actions for high-stakes changes to production infrastructure.
Limits
- Anthropic's announcement is dated October 22, before the start of our reporting window; we are covering it now because the app rollout begins next week.
- Every number above comes from Claude Code testing that Anthropic ran or commissioned. Anthropic has published no block rates or incident data for the Claude apps, where actions such as sending email or editing shared documents differ from shell commands.
- Anthropic has not given an exact rollout date beyond "next week."
- The details on manual switching, file deletion and admin settings come from AiLookout.news's reading of Anthropic's help center, which we did not open.