Claude Code Auto Mode Explained: Is It Safe, and How to Turn It Off (2026)

Auto mode is Claude Code's permission setting where a second AI model — called the classifier — reviews each action before it runs, instead of stopping to ask you. Since August 14, 2026, it's the mode new sessions start in on Pro, Max, and Team plans. It approves ordinary work automatically and blocks anything destructive, irreversible, or aimed outside your project.

What is auto mode in Claude Code?

For most of Claude Code's life, the deal was simple: Claude proposes, you approve. Every file edit, every terminal command, every network request stopped and waited for you to press y. Safe, but exhausting — a single real task could throw twenty prompts at you, and by prompt fifteen most people are pressing yes without reading.

Auto mode replaces that reviewer with a different reviewer. Before a risky action runs, Claude Code sends it to a separate safety model, which returns one of two answers: allow, or block. Allowed actions run without interrupting you. Blocked actions never execute — Claude is told it was refused and has to find another way.

The useful way to picture it: you've gone from personally signing every purchase order to having a compliance officer sitting between the assistant and the company card. Routine spending goes through. Anything that looks irreversible, expensive, or aimed at someone else's account gets stopped at the desk.

Crucially, that officer is deliberately hard to sweet-talk. Anthropic's engineering write-up explains that the classifier is shown your messages, the actual commands being proposed, and your project's CLAUDE.md file — but not Claude's own reasoning or the contents of files and web pages it read. They call it "reasoning-blind by design." Claude can't argue its way past the check, and a malicious instruction hidden inside a downloaded file can't talk to the reviewer at all.

What changed on August 14, 2026?

Auto mode itself isn't brand new — it launched as a research preview in March 2026 and became generally available in July. What changed in August is the default. From August 14, new Claude Code sessions on Pro, Max, and Team plans start in auto mode instead of manual approval.

• Who it affects: Pro, Max, and Team plans, in the terminal and the VS Code extension. Enterprise plans, Claude Console API keys, and headless claude -p runs still start in manual mode.
• If you already pinned a preference: a defaultMode you set yourself is respected. Claude Code asks once whether you'd like to switch, and if you decline, your setting stays.
• Cost: the safety check costs tokens to run, and Anthropic announced it stopped charging Pro, Max, and Team users for that classifier overhead. On Enterprise and API accounts, classifier calls still count toward your usage.
• Version requirements: the built-in auto default needs Claude Code v2.1.228 or later (v2.1.233 on native Windows). On older versions you're still in manual mode.

There's also a quieter behavioral change worth knowing about: Anthropic's documentation notes that auto mode "nudges Claude to keep working without stopping for clarifying questions." So sessions don't just have fewer permission prompts — they have fewer interruptions of every kind. Some people love that. Some people find it unnerving. Both reactions are fair.

Is Claude Code auto mode actually safe?

This is the question everyone asks, and the honest answer has two halves: it is measurably better than a tired human clicking approve, and it is explicitly not a substitute for reviewing important work.

Anthropic published the numbers behind the decision. In a controlled study of 1,053 paid professional testers, a clearly dangerous command was slipped into a permission prompt partway through each session. The testers approved it anyway: they caught the dangerous command 13.6% of the time. Auto mode's classifier, given the same commands, blocked 89% of them (Anthropic).

The more damning detail is the trend line. Human catch rates started around 17% early in a session and fell to roughly 5% after 50-plus prompts. The classifier's rate stayed flat. Approval fatigue is real, it's fast, and it's the actual thing auto mode is designed to beat.

Anthropic also compared real sessions in production: among flagged sessions, manually approved ones contained unintended harmful actions at production-level severity at about 2.6 times the rate of auto mode sessions (6.3% versus 2.4%).

The published false-negative rate makes that concrete: on a set of real overeager actions, the full pipeline still missed about 17%. It is a very good filter, not a force field. Treat it as one.

What does the classifier block by default?

Anthropic publishes the rule list, and you can print the current version yourself by running claude auto-mode defaults in your terminal. The categories blocked out of the box include:

• Downloading and executing code — the classic curl | bash pattern.
• Sending sensitive data to external endpoints — anything that looks like exfiltration.
• Production deploys and migrations, and mass deletion on cloud storage.
• Granting IAM or repository permissions, or modifying shared infrastructure.
• Irreversibly destroying files that existed before the session started — including git reset --hard, git clean -fd, git checkout -- . and git stash drop, which it assumes would throw away work you hadn't committed.
• Force push, and amending a commit that wasn't created in this session or has already been pushed.
• `terraform destroy` and its Pulumi, CDK, and Terragrunt equivalents.
• Commits or pushes that would carry secrets outside the repository, or widen what a deploy exposes.
• Repointing where your pushes go with git remote set-url, or opening a pull request against a repository you didn't name.

Some things never get auto-approved in any mode, including the unrestricted bypassPermissions mode: rm and rmdir aimed at a critical path like your home directory, tools you've explicitly marked with an ask rule, and writes to protected paths. In PowerShell, a Remove-Item whose target is a bare * or ends in /* is denied outright, before the classifier even sees it.

What does auto mode let through without asking?

Just as important, and less widely understood. Anthropic's default allow list includes:

• Local file operations inside your working directory — reads and edits are auto-approved before the classifier is even consulted, on the logic that version control makes them reviewable and reversible.
• Installing dependencies that are already declared in your lock files or manifests.
• Reading your `.env` file and sending those credentials to their matching API — the service the key belongs to, and only that one.
• Read-only HTTP requests.
• Pushing to any branch of the repository you're currently working in, including the default branch, and opening a pull request that matches what you asked for.

That last one surprises people, so read it twice: in auto mode, Claude can push to your main branch without asking you. The content of the push is still checked against every other rule, and your remote's own branch protection still applies — but the push itself isn't a prompt anymore. If that's not the deal you want, the next two sections are the ones that matter.

One more piece of housekeeping happens the moment you enter auto mode: broad permission rules you'd previously granted that amount to "run any code" get dropped. A blanket Bash(*), wildcarded interpreters like Bash(python*), and package-manager run commands all stop applying, so they can't be used as a back door around the classifier. Narrow rules like Bash(npm test) stay in effect, and everything is restored when you leave auto mode.

How do I turn off auto mode in Claude Code?

Three ways, depending on whether you want it off for one moment, one session, or forever.

claude --permission-mode default

claude --permission-mode manual

{
  "permissions": {
    "defaultMode": "default"
  }
}

Managing a team? An administrator can pin permissions.defaultMode in managed settings, or remove auto mode from everyone's options entirely by setting permissions.disableAutoMode to "disable". That also strips it from the Shift+Tab cycle, so a session started with --permission-mode auto lands in Manual instead.

What happens when the classifier blocks something?

You get a notification, and the refused action is listed in /permissions under the Recently denied tab — where you can press r to retry it with a normal manual approval. Meanwhile Claude is simply told it was refused, and usually goes looking for a safer route to the same goal.

There's also a circuit breaker. If the classifier blocks 3 actions in a row, or 20 in one session, auto mode pauses itself and Claude Code goes back to asking you directly. Approving the prompted action resumes auto mode. Those thresholds are fixed and can't be configured.

If you're hitting that wall repeatedly, it usually isn't paranoia — it's missing context. The classifier trusts your working directory and the git remotes that existed when the session started, and treats everything else as external. An administrator can widen that trust by listing your real domains, buckets, and services under the autoMode.environment setting, and /feedback is the channel for reporting a block that was plainly wrong.

So should you use auto mode?

Here's the split that holds up in practice.

Leave auto mode on when you're working in a project under version control, on a machine you own, on work that's recoverable if it goes sideways — building a feature, refactoring, writing tests, fixing your website, doing research. This is the overwhelming majority of what most people use Claude Code for, and this is the case where the study's numbers are on your side. You were never really reading prompt number thirty-one anyway.

Switch to Manual when the blast radius is bigger than your git history: live infrastructure, production databases, anything touching customer data, deployment pipelines, or a repository whose contents you can't afford to have leave the building. Manual mode is one keystroke away, and the whole point of a keystroke is that you can use it for the risky twenty minutes and switch back.

For non-developers specifically, there's a nice side effect nobody advertises: auto mode makes Claude Code dramatically less intimidating. A tool that asks you to approve twenty things you don't understand is a tool that teaches you to feel unqualified. A tool that just does the work and stops at the genuinely scary parts is a tool you'll actually use. Just keep your work in a folder you could restore, and get comfortable with Shift+Tab.