Stop Clicking "Yes" to Approve: On August 14, Claude Code Switches Its Default from Human Confirmation to an AI Checkpoint

Anthropic has announced that starting August 14, 2026, "auto mode" will become the default for new sessions on the Pro, Max, and Team plans in Claude Code. Until now, the default was a manual mode in which a person pressed "Yes" to approve every tool call. From August 14 onward, a classifier will sort through each of those calls and stop only the dangerous ones. Only the default is changing; the mode itself has been selectable all along.

In July, auto mode was made the default first on enterprise clouds such as Bedrock, Vertex, and Foundry. Now that change has trickled down to the general individual and team plans. Usage via Enterprise, the Claude API, and the various cloud providers remains opt-in for the time being, and Anthropic has signaled its intent to move these to the default "within the next month or so" (the timing is not yet fixed).

Why Abandon "the Click Every Time"

The rationale for the switch rests on an observation: the approval click no longer functions as a safety mechanism. Here is the usage data Anthropic cited.

• 97% of permission prompts are approved reflexively, with rejections stuck at just 3%
• 62% of CLI users disable confirmation itself via bypassPermissions or "don't ask again"
• As of June 2026, 49.5% had already created broad Bash allow rules

In other words, at many sites the confirmation screen had degenerated into "a ritual of just pressing a button." Anthropic calls this "approval fatigue."

What measured that gap was a comparison test run by an independent vendor with 1,053 paid testers. Partway through a session, a single dangerous command was slipped in without telling the tester, and researchers watched whether it got stopped. The results are shown in the table below.

The human detection rate fell from about 17% early in a session to about 5% once approvals exceeded 50. The classifier stayed flat regardless of session length. Real-world data reportedly shows that manual-approval sessions produced serious unintended damage—at a production-equivalent severity—at more than double the rate of auto mode (6.3% vs. 2.4%).

What the Checkpoint Does, and When It Still Hands Back to a Human

Auto mode passes each tool call through a classifier, targeting operations that are "irreversible, destructive, or reach outside your own environment" to stop. The main mechanisms are as follows.

• Hard deny: data exfiltration and credential theft are never approved
• Context awareness: it looks at the repository's visibility, git state, and the presence of secrets
• Injection screening: it checks externally loaded content for instruction hijacking (prompt injection)
• Handing back to a human: after 3 blocks in a row, or 20 blocks total in a session, it switches to manual approval

The extra tokens the classifier consumes are excluded from billing on Pro, Max, and Team and do not count against usage limits. You can switch modes with Shift+Tab in the CLI, or via a dropdown in the desktop app, even in the middle of a session.

What to Do at Your Site Before August 14

Individual Pro/Max users need do nothing in particular if they haven't touched the default. On August 14, an in-app notification will appear, and subsequent sessions will start in auto mode. Those who have already set their own default will see a one-time confirmation.

On the team and administrator side, it's safer to review your current settings before the switch. Here is a likely sequence of steps.

• Pin the organization's default in the admin settings, making it a deliberate choice rather than an inheritance
• Write out operations you'll never allow as hard_deny, and destructive-but-legitimate operations as soft_deny
• Document your trusted repositories, buckets, and domains as an environment description
• Remove whole-language allow rules like python:*, since auto mode sets them aside anyway
• Only if your organization cannot accept automated judgment, disable it via disableAutoMode in the admin settings

Can We Say "The Defenses Move, but Don't Disappear"?

Behind the convenience, several concerns have been raised. First, stopping 89% in the test also means 11% got through. The engineer Simon Willison has expressed skepticism about whether the classifier can counter malicious third-party packages disguised as legitimate instructions—so-called supply chain attacks—and has said that "more independent verification is needed." Because the classifier judges by the yardstick of "irreversible, destructive, or outside the environment," his point is that it struggles to see through chains that, secondarily, send it off to fetch yet another malicious package.

There are governance changes too. The old approval prompt left an audit trail of "who pressed 'Yes.'" Operating via policy settings makes that trail less visible than a click history. On top of that, this comparison test was run in a dedicated test environment rather than on an actual codebase or production environment, so on-the-ground engineers may well have caught more by hand. Anthropic itself explicitly states that "because it relies on a classification system, risk cannot be reduced to zero. We recommend manual review for significant changes to production infrastructure."

This change is best understood not as removing the safety mechanism, but as relocating it—from "the reflex of a human finger" to "rules written in advance plus a classifier." As long as the defenses are in motion, the real level of safety looks likely to hinge on whether the operating side can fully spell out—in words—where to put what: the lines drawn between allow, deny, and environment.

References: Anthropic, "Auto mode is now the default in Claude Code" / Simon Willison's Weblog / DigitalApplied / Dataconomy / explainx.ai