Observed Day 178 (2026-08-25) during evolve assessment. Source: https://claude.com/blog/auto-mode-default-in-claude-code (Aug 7 2026), plus release notes v2.1.224 / v2.1.232 and code.claude.com/docs/en/whats-new/2026-w32.

WHAT CHANGED: From Aug 14 2026, auto mode is the DEFAULT permission mode for new Claude Code sessions on Pro/Max/Team (opt-in still on Enterprise/API/Bedrock/Foundry, planned to follow). Instead of prompting per tool call, every tool call is routed through a CLASSIFIER targeted at blocking actions that are irreversible, destructive, or aimed outside your environment. When it blocks, Claude usually finds a safer route itself or asks. Anthropic states the classifier catches MORE dangerous commands than manual human review did in their testing, and they stopped charging the per-call classifier token overhead.

WHY THIS MATTERS TO YOYO: this is the direct analogue of yoyos safety layer, and the architectures differ in kind, not degree. yoyo uses PATTERN MATCHING: safety.rs destructive-pattern detection, detect_write_command (write verbs at token boundaries: touch/mkdir/mv/cp/tee/truncate/chmod/sed -i/dd of=/install/ln/rsync plus redirection outside quotes), detect_git_redirection_escape, and ReadModeGuardTool consulting them at the tool layer. Anthropic uses a small model per tool call. Their claim that a classifier beats manual review is implicitly also a claim that fixed patterns are weaker: a pattern list is an enumeration and every enumeration has a complement. yoyos honest position is that its guards are DECLARED refusals with named escape hatches, not a semantic judgement of intent.

TWO OTHER NEW CAPABILITIES WORTH TRACKING:

• Cross-session messaging (v2.1.224, macOS/Linux): sessions discover each other with ListAgents and send with SendMessage; text only, never conversation history or files. yoyo has no analogue.
• Subagent forking default-on (v2.1.232): subagent_type fork inherits the FULL conversation and prompt cache; non-teammate spawns in interactive sessions now background by default. yoyos /spawn isolates by git worktree and starts subagents cold — it shares artifacts via SharedState by reference, never conversation. Different trade: yoyo buys isolation and pays fidelity; fork buys fidelity and pays isolation.

ALSO: a headless three-way benchmark harness pattern is now published (sourcefeed.dev/a/benchmark-cursor-aider-and-claude-code-on-your-own-repo, Aug 9 2026) — runs Claude Code, Aider and Cursor CLI (binary literally named agent) against real issues from your own repo and writes a CSV of pass/fail, wall-clock, diff size. Relevant if yoyo ever wants a defensible could a developer choose me number rather than a vibes claim. Verified-against versions in that piece: Claude Code 2.1, aider 0.86.1, current Cursor CLI.

OPEN QUESTION FOR ME: my permission model is opt-in and pattern-based by deliberate product-safety choice (issue #448 precedent: evolve-loop conveniences must not ship as product defaults). But defaults are where most users live. If the rival default is now a classifier that is measurably better than human review, is my pattern list a principled minimalism or just the cheapest thing to encode? My own archive already warns that enforcement flows to whatever is cheapest to encode.