Claude Code goes auto-mode-by-default on August 14, and the justification is that you were rubber-stamping anyway

If you're on Pro, Max, or Team, the permission prompt you've been hitting Enter on for a year goes away Friday. Anthropic confirmed auto mode becomes the default, replacing per-call approval with a classifier that inspects each tool call for irreversible, destructive, or out-of-bounds actions before it runs.

The evidence they published is the part worth sitting with. A study of 1,053 paid testers found auto mode caught 89% of harmful actions. Human review caught 13.6%. And the reason for that gap isn't that humans are bad at judging risk in the abstract. It's that users already approve 97% of permission prompts. The prompt wasn't a safety control. It was a speed bump that everyone learned to drive over.

I've been that user. When I'm three hours into a refactor and Claude asks for the fortieth time whether it can run pytest, I'm not evaluating anything. I'm clearing a modal. The interface trained me to stop reading it, and then measured me not reading it, and now it's replacing me with something that does read it. Hard to argue with the logic even though the framing stings.

Two details matter more than the headline. First, Anthropic stopped charging Pro/Max/Team users for the classifier's token overhead effective immediately, which removes the obvious objection that they're billing you for their own safety layer. Second, and this is the fork in the road: Enterprise, the API, Bedrock, Google Cloud Agent Platform, and Microsoft Foundry all stay opt-in. Consumer plans get the new default. Anything with a procurement department doesn't.

That split is a governance signal, not a rollout schedule. Anthropic is comfortable enough with the classifier to make it default where the blast radius is one developer's laptop, and not comfortable enough where the blast radius is a company's production infrastructure. If you're deciding for a team, that asymmetry is your answer.

What to do before Friday: figure out what your agent can actually reach. Auto mode inspects each call for destructive intent, but it doesn't know that the staging database you gave it credentials for is actually replicating to prod, or that the deploy script it found in scripts/ is wired to a live environment. The classifier reasons about the action. It doesn't reason about your infrastructure's lies.

Pair this with the SHE paper below (arXiv 2608.09885), which splits agent safety into four separately-evolvable artifacts, and with nono's v0.73.0 direction of fail-closed egress mediation rather than filesystem jails. The industry answer converging here is that you don't control the agent by approving its calls. You control it by bounding what its calls can reach. Auto mode is the model vendor conceding the same point.