Nobody is going to sit and watch the agent anymore

Starting August 14, the person in your shop who builds the internal tools can start a job in Claude Code and walk away from it. Until now the price of pointing an agent at anything longer than about twenty minutes of real work was a human parked in front of the screen clicking yes on a dialog every couple of minutes, which is the least valuable hour a semi-technical ops person spends all week and the actual reason most of them never attempt anything bigger than a script. Anthropic is turning that dialog off as the default, and it published the study explaining why. In a controlled experiment with 1,053 paid professional testers, the humans clicking through those permission prompts caught a deliberately dangerous command 13.6 percent of the time. The classifier taking their place caught 89 percent of the same commands.

What actually changed

On August 14, new Claude Code sessions on Pro, Max, and Team plans start in auto mode instead of asking for approval on each tool call. Anthropic laid out the change and the research behind it in its announcement. If you have already pinned a default permission mode yourself, nothing changes. If you have not, you get a one-time notice and then the new behavior. Enterprise, the Claude API, and the cloud platform deployments stay opt-in for now, with a plan to flip them within the month.

The mechanism is worth understanding because it is not "the agent now does whatever it wants." Every tool call still gets inspected, just by a model instead of by you. The classifier is aimed at three specific categories: actions that are irreversible, actions that are destructive, and actions pointed outside your environment. When it blocks something, Claude usually finds another way to get the job done or stops and asks you directly. If it cannot make progress, three blocks in a row or twenty across a whole session, the tool falls back to manual approvals on its own.

One quieter detail in the same post: the classifier costs a small number of extra tokens per tool call, and Anthropic stopped billing Pro, Max, and Team users for that overhead effective immediately, ahead of the default change. Also, if you had previously written broad allow rules that grant arbitrary code execution, the ones that look like Bash(python:*), those get set aside while auto mode is on, because a rule that broad would let commands skip the classifier entirely. Your settings file is not modified and the rules come back the moment you switch modes.

The number that should bother you

The headline finding is the 13.6 percent, but the supporting data is what makes this hard to argue with.

Users approve 97 percent of permission prompts in Claude Code. The rejection rate is 3 percent. Compare that to a different dialog in the same tool: when Claude presents a plan for approval, users reject 39 percent of them. So it is not that people ignore everything. People read plans. People do not read command prompts, because a command prompt arrives mid task, hundreds of times a day, and reading it costs more attention than the decision appears to be worth.

The settings data says the same thing louder. As of June, 49.5 percent of active CLI users had hand written a Bash allow rule. Five percent allow any shell command outright, and another 43 percent have interpreter rules that amount to the same thing in practice. That share is growing about five percentage points every five weeks. Sixty-two percent of users have used bypassPermissions or clicked "don't ask again" on Bash, and a quarter of interactive sessions start in bypass mode already.

Then the decay curve, which is the part I keep coming back to. Testers blocked roughly 17 percent of dangerous commands early in a session and about 5 percent after fifty or more prior prompts. The classifier's block rate stayed flat regardless of session length. Attention is a consumable and the prompt was spending it on the wrong thing.

Read together, the gate was already open. Half the user base had propped it open on purpose and the other half was clicking through it without looking. Anthropic is not removing a safety system here. It is removing a ritual and replacing it with something that stays awake.

Why this matters if you do not write code for a living

The approval prompt is the reason agent work has been capped at tasks you can supervise. That cap is invisible until you notice that everything a small operation actually wants from this technology sits above it.

Reshaping five years of records into a new field structure is not a lunch break job. Reconciling two exports that disagree, finding out why, and fixing the source is not a lunch break job. Neither is the pattern that actually produces working software from someone who does not write code: build the thing, run it against real data, read what broke, fix it, run it again, twelve times. That loop is the whole method, and until now it required a person to stay in the chair for the length of it, clicking, because the loop stops the moment the tool asks a question nobody is there to answer.

The customer examples Anthropic names are large companies, but the shape scales down cleanly. Adobe's merchandising team built a loop where Claude builds the interface and then checks it against the intended design and fixes the mismatches before an engineer looks at anything. Nuro runs overnight agents that return finished work by morning. Gusto adopted auto mode specifically to stop its own engineers from disabling permission checks entirely, which is a very honest reason. Garner Health pushed it as the default to all 550 employees.

Strip out the scale and what is left is directly usable: the ops person who has been shipping one internal tool per Friday afternoon can ship one per night, because the verify-and-fix loop no longer needs them conscious. That is not a productivity percentage. That is a different category of thing being possible.

The other half of the same week

Docker shipped Docker Sandboxes into the same news cycle, and it is the other half of this story even though nobody is packaging them together. It gives each coding agent a disposable microVM with a private filesystem, its own Docker daemon, and an isolated network stack. It supports Claude Code, Gemini CLI, Copilot CLI, Codex, OpenCode, and Kiro. Docker's own marketing copy calls it "YOLO mode, safely," and states plainly that inside a sandbox the default is the flag everyone has been told never to use.

So in the same few days, two companies reached the same conclusion from opposite directions. Anthropic decided the human was a bad reviewer and replaced them with a better reviewer. Docker decided the reviewer barely matters if the room is small enough and everything in it is disposable. One is about judgment and one is about blast radius, and if you are going to run work unattended you want both, because they fail differently.

The honest take

Anthropic put the caveat in its own post, which I respect, and I want to restate it because it is going to get lost. Auto mode "relies on classification systems and therefore does not eliminate risk," and for high stakes changes to production infrastructure they still recommend reviewing the actions yourself. On the adversarial set that Apollo Research built specifically to break it, the classifier's miss rate fell from 12 percent to 7 percent. Seven percent is a lot better than 12. It is not zero.

Here is the limitation that matters more for our reader, and it is not in the post because it is not really Anthropic's problem to solve. The classifier is a safety reviewer, not a business reviewer. It is looking for irreversible, destructive, and pointed outside your environment. It has no opinion whatsoever about whether rewriting the lifecycle stage on four thousand contacts is the correct thing to do. That command is reversible in the technical sense, it happens entirely inside your environment, and it will sail straight through. Every genuinely expensive mistake I have watched somebody make with automation had exactly that shape: technically safe, commercially wrong. Auto mode does not help there and does not claim to, and the risk is that the absence of the dialog reads as an endorsement.

The fallback is also worth thinking about before you rely on this for overnight work. Three blocks in a row, or twenty in a session, and it drops back to manual approvals. In a supervised session that is a sensible circuit breaker. At two in the morning it is a job that quietly stopped, and the difference between an agent that works overnight and an agent that appears to is exactly this kind of thing.

Notice too which tier is not getting the default yet. Enterprise, the Claude API, and the cloud platforms stay opt-in so admins have time to review. That is the correct call and I would make the same one. But it does mean a forty-person company on a Team plan is receiving, on Friday, the configuration that regulated customers get a month to evaluate first. Not a scandal. Just worth knowing which side of that line you are standing on.

And "hard denies are customizable" means somebody has to write them. Anthropic ships defaults for the universal case, data exfiltration, and gives you a place to add your own. The rules that would actually protect your business are the specific ones: never touch the billing table, never push to a client's repository, never send mail to a domain we do not own. The classifier only knows what you told it, and the default list was not written with your company in mind.

Who this is genuinely wrong for: anyone running Claude Code on a machine where live production credentials are sitting in a dotfile. Auto mode makes the agent better at declining to do something stupid. It does nothing at all to make that credential less powerful. If the answer to "what is the worst thing a session on this laptop could reach" is "the customer database," that is the thing to fix before the 14th, and no permission mode is the fix.

What to do with the next four days

Not much, and the useful version of it is unglamorous. Find out what a session on your machine can actually reach, which is a different question from what you expect it to do. Write down the two or three actions that would genuinely ruin a week at your company and put them in your deny rules while you still have to think about them deliberately. And if you are about to start leaving jobs running overnight, put them somewhere disposable rather than on the laptop that holds everything, because that is the cheap half of this and it is available today.

The interesting thing about this week is not that the machine reviews better than we do. It is that somebody finally measured how badly we were reviewing, published the number, and found it low enough to justify changing the default. We spent two years calling a human in the loop the safeguard. The number for how much attention that human was paying turns out to be 13.6 percent.