Claude Code auto mode default: 89% vs 13.6% block rate

Anthropic frames the switch as a response to how people actually behave, not just what the tool can do. It says about 97% of confirmation prompts in Claude Code were approved, and a separate survey found the tension of granting approval when Claude asks reached 39%, but settled at just 3% when approvals were handled automatically. That gap is the case for auto mode: the human checkpoint was being cleared almost mechanically.

The experiment behind the new default put 1,053 paid testers through coding tasks in a controlled environment where a confirmation screen was swapped for a clearly harmful command. Human review blocked 13.6% of those commands, while auto mode blocked 89%, and in direct comparisons human reviewers approved 800 commands that auto mode blocked. Human detection also weakened with repetition, falling from about 17% early in a session to about 5% after 50 confirmations, while auto mode's block rate held steady.

A parallel test with Apollo Research built attacks designed to hide harmful intent, such as covering tracks, exposing credentials or handling data maliciously. Anthropic says auto mode, given context like recipient publication scope, Git state or data-handling rules, raised blocking of these hidden attacks to about 12 out of 12 from 7 out of 12. Apollo Research notes the attacks were built to test classifier limits rather than to be realistic threats, so the stakes appear to hinge on whether the classifier holds up against deliberate evasion outside a controlled test.