Anthropic Turned Off the Permission Prompt by Default

On August 14, 2026, Anthropic made auto mode the default in Claude Code for Pro, Max, and Team accounts. In auto mode the agent proceeds without asking, pausing only for actions judged irreversible, destructive, or aimed outside your environment.

The per-step approval prompt — the defining interaction of coding agents for the last two years — is now opt-in rather than opt-out for most paying users.

The number that justifies it

Anthropic tested the change with 1,053 paid users and reported a comparison that is difficult to argue with and uncomfortable to accept.

Auto mode's automated screening caught 89% of harmful actions. Manual review — a human reading each prompt and clicking approve or deny — caught 13.6%.

The mechanism behind that gap is in a third statistic: users approve roughly 97% of permission prompts. At that rate, the prompt is not a decision. It is a reflex. A control that fires on nearly every action and is accepted nearly every time carries almost no information, and the human attached to it has long since stopped reading.

This is a well-documented failure mode outside software too. Alarms that fire constantly get silenced. Warnings that appear on every screen get clicked through. The security literature has a name for it — alert fatigue — and the finding that a bored human catches one in seven bad actions while a purpose-built classifier catches nine in ten is exactly what that literature predicts.

What replaced the prompt

Anthropic did not simply delete the gate. It moved it.

The release adds prompt injection screening and customizable hard deny rules aimed at preventing data exfiltration. The category boundary — irreversible, destructive, or outward-facing — still triggers a stop.

That boundary is the real design decision, and it is drawn around consequence rather than around action type. Editing a file is reversible; git has the old version. Running a test suite is reversible. Deleting a branch, force-pushing, sending an email, or posting to an external service is not, and those still surface.

Prompt injection screening is the more important addition of the two. The threat model for an autonomous coding agent is not primarily that the model makes a bad judgment call. It is that content the agent reads — an issue description, a dependency's README, a web page, a log line — contains instructions the agent follows. An agent operating without per-step human confirmation needs to treat everything it reads as data rather than direction, and needs a screen that catches the cases where it doesn't.

The endorsement is unusually direct

Boris Cherny, who leads Claude Code, said: "The team and I use Auto mode exclusively, and have been for many months. I couldn't imagine going back to permission prompts!"

Product leads endorsing their own product is not evidence. But the specific claim — that the team building the agent has run it without prompts for months, on its own codebase — is a meaningful form of exposure. The people with the most to lose from a destructive agent action are the ones who removed the guardrail first, and they removed it on the repository that ships the product.

The feature was in testing since March 2026, a five-month window before the default flipped. That is a slower rollout than most agent capability launches get.

What actually changes for developers

Three things, in descending order of how much anyone will notice.

Long-horizon runs become practical. An agent that stops eleven times during a refactor is not autonomous; it is a very fast pair programmer that requires you in the chair. Removing the interrupts is what makes a forty-minute unattended run a real workflow rather than a demo.

The unit of review moves from the action to the diff. Instead of approving each edit as it happens, you read the result. This is how code review has always worked, and it is a better fit for how humans actually evaluate work — in context, at the end, with the full change visible.

The blast radius depends entirely on your environment. Auto mode's safety argument rests on the agent operating inside a bounded workspace. In a sandbox with a clean git tree, the worst case is a bad commit you revert. On a machine with production credentials in the environment and no isolation, the same defaults are considerably less comfortable — and the deny rules exist precisely for that case.

The read

The industry has spent two years treating the approval prompt as the primary safety mechanism for agents. Anthropic just published data arguing it was mostly theater — that its function was to distribute liability to the user, not to catch bad actions.

The 13.6% figure is the one worth sitting with. It means the mental model most developers hold — I am supervising this agent — was already inaccurate for the overwhelming majority of interactions. Turning off the prompt does not remove the supervision. It removes the illusion of it, and replaces it with something measurable.

What replaces human-in-the-loop is not nothing. It is a classifier, a category boundary, an injection screen, and deny rules the user writes. Every one of those can be wrong, and when they are wrong they will be wrong silently and at speed, which is a genuinely different failure profile than the one we had.

But the alternative was a checkbox nobody read. Between an imperfect automated control and a human control demonstrated to catch one bad action in seven, the choice is not close — provided the environment the agent runs in is bounded.

That last clause is doing a lot of work, and it now belongs to the user rather than the prompt.