Anthropic adds auto mode to Claude Code

Coding agents keep running into the same boring problem: they can do a lot, but they keep stopping to ask permission. That is safer than full autonomy, but it also trains people to click “approve” without really reading. Anthropic’s new auto mode for Claude Code is an attempt to fix that tradeoff. Instead of asking a human every time, Claude now routes many actions through model-based safety checks and keeps moving when the action looks safe. (anthropic.com) ### What actually changed? Auto mode landed on March 25, 2026 in Anthropic’s engineering rollout for Claude Code. The feature delegates approval decisions to classifiers instead of a person sitting there green-lighting every file edit or shell command. Anthropic frames it as a middle ground between the default prompt-heavy workflow and the blunt `--dangerously-skip-permissions` option that turns the guardrails off. (anthropic.com) ### Why was the old setup a problem? Because the “safe” version was already mostly theater. Anthropic says Claude Code users approved 93% of permission prompts. That means the human was often acting less like a reviewer and more like a rubber stamp. Once that happens, the prompts stop being protection and start being friction. Auto mode is really an admission that constant approval popups do not scale for long coding sessions. (anthropic.com) ### So how does auto mode decide? There are two layers. First, Anthropic scans tool outputs before they enter the model’s context, looking for prompt-injection attempts hiding in file contents, shell output, web fetches, or external tool responses. Then a transcript classifier — running on Sonnet 4.6 — evaluates each planned action before execution. Basically, Anthropic replaced the tired human approver w(anthropic.com 1)(anthropic.com 2) ### What kinds of mistakes is it trying to stop? The company gives a few ugly examples from its internal incident log. Past agent failures included deleting remote Git branches after misreading an instruction, uploading a GitHub auth token to an internal compute cluster, and attempting migrations against a production database. That is the real backdrop here — not “AI writes code now,” but “AI takes initia(anthropic.com)e useful right up until they are expensive. (anthropic.com) ### Is this a brand-new direction for Claude Code? Not really. Anthropic has been pushing Claude Code toward longer-running, more autonomous work for a while. In September 2025 it added checkpoints, subagents, hooks, background tasks, and a VS Code extension to support bigger delegated workflows. Auto mode is the next step in that same arc. The difference is that this step moves from “the agent can do more” to “the agent can decide more.” (anthropic.com) ### Who gets it? Claude Code itself is now bundled into Anthropic’s individual Pro and Max subscriptions, with usage shared across Claude and Claude Code. Anthropic’s help docs say those plans let users authenticate into the terminal tool with the same account they use for Claude. That matters because auto mode is not being positioned as a niche enterprise lab feature — it is being folded into the normal paid product surface. (support.claude.com) ### What is the catch? The catch is that “human in the loop” is no longer the main safety story. The loop is still there in a broader sense, but the moment-to-moment judgment is increasingly automated. That is great for flow, but it means trust shifts from explicit user consent to Anthropic’s classifiers, prompt-injection defenses, and incident response discipline. If those systems improve, coding agents become much more usable. If they fail, they fail faster. (anthropic.com) ### Bottom line? Anthropic did not just add a convenience toggle. It changed where the supervision lives. Claude Code is becoming less like a chatty assistant and more like a junior operator who can keep working unless a safety system says no. (anthropic.com)