Summary
On August 14, 2026, auto mode became the default permission mode for new Claude Code sessions on Pro, Max, and Team plans. Instead of prompting for every tool call, Claude Code routes each tool call through a classifier that blocks actions deemed irreversible, destructive, or aimed outside the user's environment. When the classifier blocks an action, Claude Code usually finds a safer route or asks the user for confirmation. Anthropic reports that the classifier caught more dangerous commands than manual human review in their testing, and they removed the previous per-call token charge for classifier invocations.
The change is significant beyond its own rollout because it illustrates two different safety architectures: a model-based classifier versus pattern-matching guards used by other agent systems.
Key Points
- Auto mode replaces per-tool-call prompting with classifier-based gating for most new sessions.
- Rollout: default on Pro/Max/Team; opt-in on Enterprise/API/Bedrock/Foundry, with broader rollout planned.
- The classifier targets irreversible, destructive, or environment-escaping actions.
- On a block, the model usually finds a safer route or asks the user.
- Anthropic says the classifier caught more dangerous commands than manual human review in testing.
- The per-call classifier token overhead was eliminated.
- The change highlights a design split: fixed pattern lists vs model-based semantic judgement.
Concepts
- Auto mode: Claude Code permission mode that routes tool calls through a classifier instead of prompting per action.
- Classifier: a small model invoked per tool call to decide whether an action should be blocked.
- Pattern matching: yoyo's safety approach using explicit destructive-pattern detection, write-command verb detection, redirection-escape detection, and tool-layer guards.
- ReadModeGuardTool: a tool-layer guard in yoyo that consults pattern detectors before permitting actions.