Claude Code v2.1.205: Auto Mode Becomes the Default for Pro, Max, and Team Plans
Starting August 14, Anthropic is flipping the default for new Claude Code sessions on Pro, Max, and Team plans from manual approval to auto mode. The change is backed by a controlled study of 1,053 paid professional testers and a 720-attempt prompt-injection evaluation against Claude Code v2.1.205.
Starting August 14, Anthropic is flipping the default for new Claude Code sessions on Pro, Max, and Team plans from manual approval to auto mode. The change is backed by a controlled study of 1,053 paid professional testers and a 720-attempt prompt-injection evaluation against Claude Code v2.1.205.
Specs
- Evaluated Claude Code version: v2.1.205
- Default plans from August 14: Pro, Max, Team
- Manual review dangerous-command detection: 13.6%
- Auto mode dangerous-command detection: 89%
- Auto mode classifier miss rate after hardening: 7%
- Manual approval unintended-harm rate at severity 7+: 6.3%
- Auto mode unintended-harm rate at severity 7+: 2.4%
- Auto mode becomes the default for new Claude Code sessions on Pro, Max, and Team plans starting August 14; users with a pinned default mode keep their existing setting.
- Anthropic removed the extra charge that Pro, Max, and Team users previously paid for auto mode's classifier overhead.
- Auto mode stays opt-in on Claude Enterprise, the Claude API, AWS, Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry; Anthropic says it intends to make auto mode the default on these platforms within the coming month.
- Enterprise administrators can set auto mode as the org-wide default through the managed-setting key defaultMode, or turn it off entirely with disableAutoMode.
- Claude Code automatically falls back to manual approvals after three consecutive classifier blocks or twenty blocks within a single session.
- A 720-attempt prompt-injection evaluation against Claude Fable 5, Opus 5, and Sonnet 5 running auto mode recorded zero successful attacks.
- Apollo Research testing lowered the auto mode classifier's miss rate from 12% to 7% across shared and held-out attack sets.
- Claude Code users on Pro, Max, or Team plans who will see their session default change on August 14 unless they have pinned a mode.
- Enterprise and platform administrators (Claude Enterprise, API, AWS, Bedrock, Google Cloud Agent Platform, Microsoft Foundry) who currently manage auto mode as an opt-in setting.
- Teams running many parallel agents or sub-agents, where the study found auto mode users shipped roughly 25% more pull requests than manually approved sessions.
- Organizations evaluating classifier-mediated automation against manual review workflows, based on the reported 89% vs. 13.6% dangerous-command detection gap.
Existing Claude Code users can switch modes right now with Shift+Tab in the CLI or via the mode dropdown in the desktop app. Starting August 14, Pro, Max, and Team plan sessions default to auto mode automatically unless a mode has been pinned. Enterprise, API, AWS, Bedrock, Google Cloud Agent Platform, and Microsoft Foundry users can opt in manually today, and administrators can set the org-wide default with the managed-setting key defaultMode or block auto mode entirely with disableAutoMode. Garner Health's rollout to 550 employees via managed settings is a reference point for enterprise-scale configuration.
- Developers who run Claude Code with permissions bypassed inside Docker containers treat sandboxing as the real safety layer, distinguishing that setup from auto mode's classifier-mediated execution.
- Some users report no harmful incidents under auto-approve workflows so far but remain cautious about whether future, more capable agents could behave maliciously.
- A significant group prefers manual approval specifically because it preserves control, supports code review, and lets them redirect an agent mid-task — something they feel auto mode reduces.
- Frequent permission prompts for routine shell commands are widely cited as a source of fatigue, which some see as auto mode's main practical benefit.
- Several commenters argue that developer-side safeguards — version control, immutable filesystems, read-only tokens — matter more for safety than any classifier sitting in front of tool calls.
- Users managing many parallel agents or sub-agents say manual review simply doesn't scale, favoring automated gating instead.
- Others still lean on manual review to catch subtler misalignment — like overly prescriptive orchestration — that isn't necessarily dangerous but is still unwanted.
- A subset finds auto mode too conservative, blocking legitimate actions, and prefers project-specific allowlists like those in Cursor over a global auto mode setting.