Anthropic Claude: New Security Feature Automates Agent Access Approvals

Key Takeaways

• Anthropic is implementing a new “auto mode” security feature for Claude Code to automate the approval of potentially risky commands.
• This change, effective August 14, 2026, will make auto mode the default for new sessions on Pro, Max, and Team plans, replacing manual human approvals.
• Research by Anthropic revealed that human reviewers suffered from “approval fatigue,” approving 97% of requests and missing 86.4% of dangerous commands, while auto mode caught 89% of threats.
• Auto mode significantly enhances security by classifying and blocking irreversible, destructive, or out-of-environment actions, and has demonstrated superior resilience against sophisticated adversarial attacks compared to human review and competitor models.

Anthropic Automates Claude Code Security with New Auto Mode

Anthropic is fundamentally altering the security protocols for Claude Code, transitioning from a system reliant on frequent human approval prompts to an automated safety classifier dubbed “auto mode.” This strategic move aims to enhance the security and efficiency of AI coding agents by mitigating human error and fatigue.

Effective August 14, 2026, auto mode will become the standard setting for all new sessions across Claude Code’s Pro, Max, and Team subscription tiers. This represents a substantial shift in how AI-powered coding environments balance operational autonomy with robust security measures.

Addressing Human Approval Fatigue

The decision to implement auto mode follows extensive internal and third-party evaluations that compared manual permission prompts against the automated review system. Anthropic’s findings revealed a critical vulnerability: human reviewers exhibited significant complacency, routinely approving 97% of all permission requests within Claude Code. This high approval rate often stemmed from reflexive actions rather than diligent scrutiny, creating a substantial security gap.

Further controlled studies underscored this issue. In an experiment involving 1,053 professional testers, human reviewers detected only 13.6% of dangerous commands surreptitiously introduced into their workflows. In stark contrast, auto mode’s classifier successfully identified 89% of the identical threats, demonstrating its superior detection capabilities.

Auto mode blocked 800 commands that humans had previously approved, while humans only managed to block 6 commands that auto mode missed. Notably, human vigilance deteriorated over time; the catch rate dropped from 17% in early stages to a mere 5% after 50 or more prompts. Auto mode, however, maintained a consistent detection rate throughout extended sessions.

How Auto Mode Functions

Instead of constantly interrupting users with permission prompts, auto mode routes every tool call through an intelligent classifier. This system is specifically engineered to block actions deemed irreversible, destructive, or those attempting to operate outside the user’s designated environment. When a risky action is flagged, Claude typically attempts to identify a safer alternative or directly seeks user confirmation. Should three consecutive blocks occur, or twenty blocks within a single session, Claude Code automatically reverts to manual approval mode.

Existing permission rules generally retain precedence, though overly permissive “allow-rules”—such as unrestricted Python or Node execution—are temporarily bypassed when auto mode is active. This ensures that such broad permissions do not allow commands to circumvent the automated classifier entirely.

Enhanced Security and Performance

Beyond routine command review, auto mode has proven resilient against sophisticated adversarial tactics. During a two-week red-teaming engagement with Apollo Research, the classifier’s miss rate against adversarial attacks decreased from 12% to 7% following hardening efforts.

In prompt-injection tests conducted by Trajectory Labs, auto mode-enabled Claude models successfully thwarted all 720 attack attempts. This stands in contrast to OpenAI’s GPT-5.6 Sol, operating in Codex’s comparable auto-review mode, which exhibited a 5.83% success rate for attackers.

Internally, Anthropic has confirmed that auto mode has already prevented several real-world security incidents. These include blocking an attempted data leak to a public code-sharing platform, preventing a mass pod-kill that would have disrupted in-flight training jobs, and intercepting an over-privileged cloud access request that would have granted full administrative control instead of the intended read-only billing access.

In addition to its security benefits, auto mode is designed to enable Claude to operate autonomously for longer durations without interruption, a feature particularly advantageous for long-running models like Claude Opus 5.

Anthropic reports that Teams and Enterprise users leveraging auto mode have seen approximately a 25% increase in pull request submissions. Several prominent companies, including Adobe, Nuro, Gusto, and Garner Health, have already adopted auto mode as their default production setting. They are utilizing it for diverse applications such as powering overnight research agents, automating multi-country webpage verification, and standardizing development workflows for hundreds of employees.

Currently, auto mode remains an opt-in feature for Claude Enterprise, the Claude API, and cloud platforms including AWS, Google Cloud, and Microsoft Foundry. This phased rollout provides administrators with ample time to evaluate the change before Anthropic extends the default implementation to these platforms in the coming month.

Anthropic has also ceased charging Pro, Max, and Team users for the additional token overhead required by the auto mode classifier. For cybersecurity teams, this development signals a broader industry shift: as AI coding agents increasingly undertake autonomous and extended tasks, automated risk classification systems are proving to be a more reliable safeguard than human oversight, which is susceptible to fatigue from repetitive approval requests.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.