Auto Mode lets Claude Code run automated multi-step coding tasks end-to-end
- Anthropic’s March 25, 2026 Auto Mode update for Claude Code lets the coding agent approve many routine actions itself instead of stopping for every click. - The telling stat is 93%—users were already approving nearly all permission prompts, so Anthropic built classifiers to filter risky actions instead. - It matters because coding agents are running longer now, but the safety model is shifting from constant approval to selective oversight.
Coding agents are getting stuck on a very human bottleneck — the approval button. Claude Code could already read a repo, edit files, run tests, and push through multi-step work. But by default it kept stopping to ask permission before commands and file changes. Anthropic’s new Auto Mode changes that. It lets Claude Code keep moving on many routine actions while model-based safety checks decide when a human actually needs to step in. (anthropic.com) ### Why was the old workflow so annoying? The basic problem was approval fatigue. If an agent asks for permission over and over, people stop treating each prompt like a real safety decision and start clicking through. Anthropic says Claude Code users approved 93% of permission prompts anyway, which is a strong sign the manual checkpoint had become more ritual than review. (anthropi([anthropic.com)hat is Auto Mode actually doing? Auto Mode is basically a middle layer between full manual review and the very risky “just let it do anything” setting. Instead of asking you to approve every action, Claude Code sends actions through model-based classifiers that decide whether the step looks aligned with the user’s intent and safe enough to run. The idea is simple — automate the boring approvals, keep the meaningful ones. (anthropic.com) ### What does it check on the way in? Anthropic split the defenses into two parts. First, there’s an input-side prompt-injection probe. That scans tool outputs — file reads, shell output, web fetches, and external tool responses — before they get folded into the agent’s context. If something looks like an attempt to hijack the model, the system flags it so Claude treats that content as suspicious instead of obediently following it. (anthropic.com) ### What does it check before acting? Then there’s the output-side review. A transcript classifier, running on Sonnet 4.6, evaluates each action before execution and stands in for the human approver on many routine steps. That matters because Anthropic’s own incident log includes exactly the kinds of overeager agent behavior developers worry about — deleting remote Git branches afte(anthropic.com)ter, and trying migrations against a production database. (anthropic.com) ### Is this the same as “full autonomy”? Not really. Anthropic had already been moving Claude Code toward longer autonomous runs with checkpoints, subagents, hooks, and background tasks. Checkpoints save code state before each change so users can rewind, and hooks can automatically run things like tests after edits. Auto Mode fits that same direction, but it is more about replacing (anthropic.com 1)(anthropic.com 2) ### Why launch this now? Because the usage pattern already shifted. Anthropic’s February 18, 2026 research says long Claude Code sessions nearly doubled in three months — from under 25 minutes to over 45 minutes among the longest-running sessions. More experienced users also used full auto-approve more often, rising from roughly 20% of sessions for newer users to o(anthropic.com)Auto Mode is Anthropic trying to make that behavior safer and more structured. (anthropic.com) ### What’s the real change for developers? The real change is where trust lives. Before, trust sat in a stream of human clicks. Now Anthropic wants trust to sit in layered controls — prompt-injection screening, action classifiers, checkpoints, and the option to interrupt or rewind. That is a much more scalable setup for multi-file coding work, but the catch is obvious: you are trust(anthropic.com)is dangerous. (anthropic.com) ### Bottom line? Auto Mode is Anthropic admitting that “ask the human every time” does not scale once coding agents start acting like real collaborators. The bet is that selective, model-mediated oversight can be safer than endless manual approval — not because the model is perfect, but because humans were already tuning the warnings out. (anthropic.com)
