This is incredible.
Anthropic just made an insane change to Claude Code that will massively improve your productivity as a developer — although it might seem scary at first.
Claude Code now automatically executes commands and make tools calls by default when coding — no more stopping to ask for permission.
It won’t do this anymore:
And I know at first glance some developers will be seriously worried about this — won’t this potentially lead to disaster like file/database wipeouts or corruption from unsafe tool calls?
But actually this line of thinking is completely wrong — especially from what Anthropic discovered from their internal research.
In internal testing conducted by Anthropic across 1,053 paid participants, humans caught disguised dangerous commands only 13.6% of the time. After 50 consecutive permission prompts, detection dropped to roughly 5% as approval fatigue kicked in.
So it looks like it’s actually we humans we need to be concerned about when it comes to verifying commands.
So Claude Code now uses a background classifier to automatically know which commands are safe and which aren’t.
And the difference was absolutely insane — the automatic system was almost 7 times better at catching dangerous commands
Claude Code’s background classifier demonstrated a substantial security advantage, identifying and blocking 89% of destructive commands that might otherwise have been executed.
So of course once they saw the massive improvement it only made sense to make it the default in versions of Claude Code — Pro, Max, and Team.
And this change gives us so many benefits beyond just security.
Claude Code is no longer going to stall in its execution just to ask you to approve a command — you can finally experience the full value of long-horizon autonomous coding.
Anthropic reports that teams using it ship roughly 25% more pull requests because long-running agents can continue working without repeatedly waiting for human approval.
I found it pretty annoying at times — I would give Claude a prompt and expect it to be done when I come back — only to find out that it has barely even done anything — all because it’s waiting for me to approve a command.
I’m not the only one too:
Now I will have complete certainty that when I come back I will see results.
And also the background classifier is completely free — zero cost on all the complex logic or token usage of checking if a command is safe or not.
And free for all plans too.
Anthropic fully absorbs the computational cost of Claude Code’s background classifier, allowing Pro, Max, and Team users to benefit from continuous automated security checks without consuming any additional usage allocation.
So you don’t need to spend more just to be able to code with peace of mind.
And Auto Mode isn’t only looking for obviously dangerous shell commands — also helps defend Claude against indirect prompt injection.
So like if Claude reads a third-party package, webpage, or scraped file that has hidden instructions telling it to ignore the user and steal credentials.
Claude could potentially interpret those instructions as legitimate.
So this new Auto Mode adds another security boundary — the classifier always makes sure to compare Claude’s proposed action with the user’s original intent.
And this is especially important for autonomous agents because the more information they take in from the outside world, the larger their prompt-injection attack surface becomes.
Of course an AI supervising another AI creates its own problem — what happens when the security classifier repeatedly blocks Claude due to false positives?
Anthropic took this into consideration and built in an escalation mechanism.
If the classifier blocks three consecutive commands or reaches 20 blocked actions during one session, Claude Code automatically exits autonomous execution and returns control to the human.
One rejection might simply mean Claude chose a risky approach.
Twenty means something probably deserves human attention.
Auto Mode isn’t perfect tho — Anthropic still recommends human oversight for high-stakes production operations.
But the direction is really fascinating.
We originally put humans in the loop because we didn’t trust AI — then humans started clicking “Approve” without reading.
So now Anthropic has decided to put another AI in the loop to supervise the first one.