Anthropic unveils Claude Code auto mode
- Anthropic rolled out auto mode for Claude Code, a new permission system that lets its coding agent keep working through longer tasks with fewer stop-and-ask prompts. - The big tell is how often users were already saying yes: Anthropic says developers approve 93% of Claude Code permission prompts, so auto mode targets that friction. - It matters because coding agents are moving from autocomplete to execution, and permission fatigue was becoming the bottleneck.
Coding agents are starting to look less like fancy autocomplete and more like junior operators. They read a repo, edit files, run commands, and loop until tests pass. The problem is that every useful step can also be a risky step. Anthropic’s new auto mode for Claude Code is its answer to that tension — less babysitting than manual approvals, but less recklessness than just turning safeguards off. (anthropic.com) ### What actually changed? Auto mode is a new permission setting inside Claude Code. Normally, Claude Code stops and asks before it runs commands or edits files. Some developers got around that with a flag called `--dangerously-skip-permissions`, which does exactly what it sounds like. Auto mode sits in the middle. It lets Claude make some permission decisions on its own, so longer coding tasks can keep moving without constant human clicks. (anthropic.com) ### Why did Anthropic build a middle mode? Because the old setup had two bad options. One was approval spam — constant prompts that break flow. The other was full trust — which is fast, but risky. Anthropic says Claude Code users approve 93% of permission prompts anyway, which is basically a sign that the system was asking humans to rubber-stamp routine actions over and over. Auto mode is meant to cut that approval fatigue without pretending every action is safe. (anthropic.com) ### So what does auto mode decide by itself? It uses classifiers — basically separate safety models — to judge whether a command or file operation looks routine or risky. If the action looks safe enough, Claude can proceed without interrupting the user. If it looks suspicious, the system still asks for approval or blocks the action. Anthropic frames this as a permission layer, not a free pass for full(anthropic.com)eeper around those tools got smarter. (anthropic.com) ### What kinds of risk is it trying to catch? The obvious stuff is destructive commands and sensitive data exposure. But the deeper issue is prompt injection and tool misuse. A coding agent can be tricked by malicious instructions hiding in files, docs, or web content, then turn that bad instruction into a real command. Anthropic has been building toward this for a while — earlier Claude Code updates (anthropic.com)lesystem and network sandboxing to constrain what the agent can touch. Auto mode extends that same idea at the permission layer. (anthropic.com) ### Is this the same as “fully autonomous coding”? Not really. The marketing arc across the industry points that way, but this feature is more about controlled autonomy. Claude Code can already work across files, run tests, and deliver committed code. Auto mode changes how often a human has to step in during that loop. That sounds small, but it is the difference between an agent that feels like a demo and one that can stay useful for a real half-hour task. (anthropic.com) ### Why does that matter now? Because the bottleneck in coding agents is no longer just model intelligence. It is operational trust. If a model is good enough to attempt multi-step development work, then the next problem is how to let it keep going without opening the door to accidental damage. Anthropic is basically admitting that “just ask the human every time” does not scale, but “let it do anything” is still reckless. That middle-ground design is the real news here. (anthropic.com) ### What’s the catch? Classifiers are judgment calls wrapped in software. They reduce noise, but they can miss context. A command that looks harmless in one repo can be dangerous in another. Anthropic says auto mode increases safety relative to skipping permissions entirely, not that it eliminates risk. So this is best understood as a practical control system for teams that want more agent throughput without giving up oversight. (anthropic.com) ### Bottom line? Anthropic did not unveil a robot programmer that runs wild. It shipped a smarter brake-and-gas pedal for Claude Code. And turns out that may be the more important step — because the real race in AI coding now is not just who can generate code, but who can let agents act without making teams nervous. (anthropic.com)
