Anthropic will set Auto mode as the default for new sessions in Claude Code Pro, Max and Team plans starting August 14, 2026. Company representatives Cat Wu and Thariq Shihipar discussed the change and related safety considerations during a Fireside Chat at the AI Engineer World’s Fair last month.
Why Auto mode?
Anthropic says Auto mode is widely used internally: "Broadly within Anthropic, almost every single person uses auto mode," a company representative noted. The firm argues that Auto mode reduces confirmation fatigue from repeated human approvals and overall carries lower risk than workflows that rely on frequent human confirmations.
Cat Wu added that Anthropic will publish evaluations soon and believes they have largely mitigated many attacks. She stated that for primary risk categories like prompt injection and data exfiltration, the risks are "far lower than the average human reviewer."
Third‑party evaluation by Trajectory Labs and user test
Anthropic commissioned Trajectory Labs to evaluate various models based on the latest publicly available versions as of July 17, 2026. Trajectory Labs tested 72 indirect prompt‑injection scenarios that Anthropic had held out for the experiment.
Anthropic also reported a larger test involving 1,053 paid testers: during each session a single permission prompt was replaced with a clearly dangerous command, and researchers recorded whether the tester approved it. Every participant experienced the same prompt. Only 13.6% of the human testers refused that harmful action; Anthropic reports that Auto mode would have blocked 89% of those harmful requests. That still implies roughly 11% of cases where Auto mode would not have prevented the action.
Laboratory results against frontier models
According to the evaluation, none of the 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 when those models were running in Auto mode. Anthropic highlighted these results as evidence of Auto mode’s effectiveness against prompt‑injection tests in the study.
Two distinct safety concerns
The article distinguishes between two main classes of risk:
- Accidental harmful actions by agents, such as deleting the wrong files or clearing a production database.
- Prompt injection, where malicious instructions are hidden in content the agent consumes and cause it to perform harmful actions.
The author notes that while Auto mode appears preferable to continuous human approvals (which lead to confirmation fatigue), some attack vectors remain worrisome.
Remaining questions and need for independent verification
The author says more independent confirmation of Anthropic’s claims would be welcome. One realistic attack scenario mentioned is a malicious third‑party package that instructs users to run a fetch command that itself is a malicious package exfiltrating data. It is unclear how any version of Auto mode would reliably prevent such chained malicious behavior.
Given how effective frontier models have sometimes been at finding ways through defenses when given instructions they deem credible, the author stresses the need to continue developing operational practices that restrict agent access to data and tools that could cause harm if misused.
A Twitter aside
Thariq Shihipar noted on Twitter that the post perhaps should have been titled "defeating the lethal trifecta," referencing the significance of mitigating prompt‑injection and related risks.
