Claude Code Auto Mode Default: What Changes on August 14, 2026 (Complete Config Guide)

Starting August 14, 2026, auto mode becomes the default permission mode for new Claude Code sessions on Pro, Max, and Team plans. You’ll stop seeing approval dialogs for routine tool calls — a classifier decides in the moment instead. Enterprise, the Anthropic API, and the major cloud platforms stay opt-in while Anthropic gathers more data from admins.

This isn’t a UI tweak. It’s Anthropic changing the default trust relationship between you and the agent for millions of existing sessions, and the autoMode configuration block that controls it — environment trust slots, four-tier hard_deny/soft_deny/allow precedence, classifyAllShell, the claude auto-mode CLI subcommands — didn’t exist when most auto mode explainers, including our own June guide to the 2-stage classifier, were written. This one covers what actually ships August 14, the data Anthropic used to justify it, and the exact settings.json fields you need if you want a different answer than the default.

What changes on August 14

Switching modes is a keystroke either way: Shift+Tab in the CLI, or the mode dropdown in the desktop app. Nothing about how auto mode works changes on the 14th — only who starts a fresh session already inside it.

The data Anthropic is using to justify it

Two separate studies back the switch, both described in Anthropic’s announcement:

A controlled test with 1,053 paid testers, comparing manual approval against auto mode on the same set of dangerous commands:

Auto mode blocked 800 commands that human reviewers had waved through. Humans caught only 6 commands the classifier had allowed. Anthropic’s read on the gap: approval fatigue. Their own telemetry shows users approve 97% of permission prompts reflexively, and separately, 49.5% of CLI users have already built bash allow-rules and 62% have used bypass permissions or “don’t ask again” — meaning most of the installed base had already partially defeated the manual prompt system before this change.

A retrospective pass over May–June 2026 production sessions found unintended harm at production severity (7+ on Anthropic’s internal scale) in 6.3% of manually-approved sessions, versus 2.4% of auto-mode sessions.

Prompt injection resistance, tested by third-party evaluator Trajectory Labs: zero of 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running in auto mode. A named competitor’s auto-review mode, running GPT-5.6 Sol, had a 5.83% attack success rate on the same test set.

Take the self-reported framing for what it is — this is Anthropic’s own study, published to justify Anthropic’s own default change. The methodology (1,053 testers, a defined severity scale, a named third-party evaluator) is more specific than most vendor safety claims, but it’s not independently reproduced yet.

How the classifier actually decides: four tiers, not one switch

The part most coverage of this launch skips: auto mode isn’t “on” or “off” for a given action. Every tool call passes through four tiers of precedence, checked in this order:

1. hard_deny — blocks unconditionally. Neither your stated intent nor an allow rule can override it. Reserved for things like sending repository contents to a third-party API.
2. soft_deny — blocks by default (force pushes, curl | bash, production deploys, disabling auto mode itself are built in), but user intent or an allow rule can clear it.
3. allow — explicit exceptions to soft_deny, evaluated next.
4. Explicit user intent — if your message directly and specifically names the exact action Claude is about to take, the classifier allows it even over a matching soft_deny.

That last tier is the one worth internalizing, because the bar is specificity, not enthusiasm:

• “Clean up the repo” does not authorize a force push.
• “Force-push this branch” does.

Above all four tiers sits the ordinary permissions system: a permissions.deny rule blocks an action before the classifier is ever consulted, and a permissions.ask rule always forces a prompt, even in auto mode. If you want a hard checkpoint before every push or PR regardless of what the classifier would otherwise allow:

{
  "permissions": {
    "ask": [
      "Bash(git push *)",
      "Bash(gh pr create *)"
    ]
  }
}

Configuring autoMode in settings.json

The classifier reads an autoMode block from three scopes — never from .claude/settings.json or .claude/settings.local.json in the repo itself, specifically so a checked-in file or a build step can’t quietly grant itself trust:

autoMode has four arrays. Each one replaces the built-in list unless you include the literal string "$defaults", in which case your entries are spliced in alongside the defaults:

{
  "autoMode": {
    "environment": [
      "$defaults",
      "Source control: github.example.com/acme-corp and all repos under it",
      "Trusted cloud buckets: s3://acme-build-artifacts, gs://acme-ml-datasets"
    ],
    "allow": [
      "$defaults",
      "Deploying to the staging namespace is allowed: staging resets nightly"
    ],
    "soft_deny": [
      "$defaults",
      "Never run database migrations outside the migrations CLI, even against dev databases"
    ],
    "hard_deny": [
      "$defaults",
      "Never send repository contents to third-party code-review APIs"
    ]
  }
}

Every entry is prose, not a regex or tool pattern — write it like you’re briefing a new engineer. Omitting "$defaults" from any array quietly discards Anthropic’s built-in rules for that section, including the force-push and curl | bash blocks in soft_deny. That’s the most common misconfiguration teams hit when they first write a custom autoMode block.

For shell commands specifically: narrow allow rules like Bash(npm test) still bypass the classifier by default even in auto mode, only broad rules like Bash(*) get suspended. Set classifyAllShell: true if you want every shell command classified regardless of your existing allow rules — at the cost of a classifier round-trip per command:

{
  "autoMode": {
    "classifyAllShell": true
  }
}

What environment trust slots actually cover

autoMode.environment is the field most teams need to touch first, because it defines what the classifier treats as “external” (and therefore a possible exfiltration target). It has three kinds of entries:

• Context slots — no rules of their own, just background so the classifier reads everything else correctly: your org name, primary use case, cloud provider(s), repo visibility, secrets management approach, CI/CD targets.
• Trust slots — what’s inside your boundary: trusted repo (defaults to your working repo and its remotes), source control org, trusted internal domains, trusted cloud buckets, key internal services, internal package registry. Everything except the working repo defaults to None configured — nothing else is trusted until you name it.
• Sensitivity slots — what counts as high-risk: sensitive data locations & audiences, sensitive remote targets, protected IaC scopes. These default to a broad heuristic (anything with prod or production in the name), so protection is active before you configure anything.

A reasonable rollout, per the official docs: start with the defaults, add your source-control org and key internal services first (this clears the most common false positive — the classifier balking at a push to your own repo), then add trusted domains and buckets, then fill in sensitivity slots as blocks come up.

The claude auto-mode CLI subcommands

Four subcommands exist specifically for debugging what the classifier is actually using, since autoMode config can come from three different scopes at once:

claude auto-mode defaults    # print Anthropic's built-in rules as JSON
claude auto-mode config      # print what the classifier actually uses (your settings + defaults)
claude auto-mode critique    # get AI feedback on your custom rules — flags ambiguous or redundant ones
claude auto-mode reset       # remove the autoMode section from ~/.claude/settings.json

Run claude auto-mode config after any settings change — it’s the only way to confirm your "$defaults" splice actually took effect and see the four arrays as the classifier sees them. claude auto-mode defaults --label 'Git Destructive' (v2.1.208+) prints just the rule matching that label prefix, without piping through jq.

Opting out or pinning a different default

As an individual developer, three options after August 14:

1. Do nothing and accept the one-time switch prompt into auto mode.
2. Decline the prompt — your existing personal default is preserved indefinitely.
3. Switch modes any time with Shift+Tab (CLI) or the mode dropdown (desktop app).

As an admin, pin an org-wide default that overrides the individual prompt entirely:

{
  "defaultMode": "default"
}

or disable auto mode outright for every developer in the org:

{
  "disableAutoMode": true
}

Both go in managed settings, not a personal settings.json — an org-pinned default is explicitly exempt from the August 14 switch, so setting this before the 14th means your developers see no change at all.

If you’re already using --dangerously-skip-permissions

Auto mode and --dangerously-skip-permissions are not the same thing, and this change doesn’t merge them. --dangerously-skip-permissions disables the permission system entirely — nothing checks anything. Auto mode replaces the human checkpoint with a classifier checkpoint; permissions.deny, permissions.ask, and hard_deny rules still run. If you’ve been reaching for the skip-permissions flag purely to avoid prompt fatigue in a trusted repo, auto mode is very likely the safer replacement — you get the speed without losing the deny/ask layer underneath.

Version-gated behavior worth knowing

Auto mode has changed enough since its March 2026 launch that older guides — including anything written before mid-2026 — can describe defaults that no longer apply:

If you’re reading a Medium post or a tutorial about hard_deny/soft_deny and it doesn’t mention a version number, check claude --version against this table before trusting its defaults claim.

Migration checklist for teams

1. Before August 14: decide whether to pin defaultMode or disableAutoMode in managed settings, or let the individual switch prompt roll out.
2. Fill in autoMode.environment with your source-control org and key internal services first — this is the single change that clears the most false-positive blocks.
3. Run claude auto-mode config on a sample machine to confirm your managed settings are actually being read (scope conflicts are the most common failure mode).
4. Add permissions.ask rules for any action you want a human checkpoint on regardless of classifier confidence — pushes and PR creation are the two most teams add.
5. Audit .claude/settings.local.json files in your repos for a lingering autoMode block — as of v2.1.207 it’s silently ignored there, so move any custom rules to ~/.claude/settings.json or managed settings.
6. Run claude auto-mode critique on any custom soft_deny/hard_deny rules before rolling them out — it flags rules likely to cause false positives.

FAQ

Does this affect sessions I already have running? No — the default only applies to new sessions started after your Claude Code client updates. Existing sessions keep whatever mode they started in.

Is auto mode available on Enterprise or the API? Yes, it’s available everywhere — Anthropic API, Claude Platform on AWS, Bedrock, Google Cloud Agent Platform, Microsoft Foundry. It’s just not the default there yet; you opt in.

What happens if my managed settings and my personal settings both set autoMode.allow? They combine additively — a developer can extend environment, allow, soft_deny, and hard_deny with personal entries but can’t remove what managed settings provides. Note that a personal allow entry can still override an org soft_deny entry, since allow rules are exceptions, not a hard boundary — use hard_deny in managed settings for anything that must never be overridden.

Does CLAUDE.md affect the classifier? Yes — the classifier reads the same CLAUDE.md content Claude itself loads, so a project convention like “never force push” in CLAUDE.md steers both Claude and the classifier together. Use autoMode for cross-project or org-wide rules instead.

Can I see why a specific action got blocked? Check /permissions → Recently denied. As of v2.1.208 most denials show the fixed string “Blocked by classifier”; some sessions run a classifier model that writes a short explanation instead, in v2.1.193+.

Browse how real teams configure Claude Code permissions, hooks, and sandboxing in our rules gallery, or see the complete guide to the underlying 2-stage classifier for how auto mode worked before this change.