Claude auto mode is now the default: what it does, how it differs from accept edits and bypass permissions, and how to turn it off

Claude auto mode is a permission setting in which a separate classifier model reviews Claude's actions and blocks risky ones, instead of asking you to approve each step. It has been the default for new Claude Code sessions on Pro, Max and Team plans since August 14, 2026. On October 22, 2026, Anthropic said auto mode is "rolling out next week as the default for new sessions in most Claude apps" on those plans; its Claude account on X named the web, desktop and mobile apps. You can switch back to manual approval at any time, and administrators can turn auto mode off.

This guide is based on Anthropic's Claude Code documentation on permission modes, its weekly "What's new" digests, its August 7 and March 24 product posts, its March 25 engineering post on how auto mode was built, its Claude account's October 22 post on X, and its Claude help center articles on Cowork, checked October 25, 2026. For why permission defaults matter on agents that run commands, see the case against unattended agents.

The short version

• What it is: auto mode lets Claude act without routine permission prompts. A classifier checks each action that isn't already allowed and blocks anything that "escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read," per Anthropic's docs.
• Claude Code: the default for new sessions on Pro, Max and Team since August 14, 2026. From version 2.1.283, the docs say it's the built-in starting mode for interactive terminal and VS Code sessions on every plan and provider.
• Claude apps: Anthropic said on October 22 that new sessions in most Claude apps (web, desktop and mobile) on Pro, Max and Team will default to auto mode starting next week. No exact date has been published.
• Not the same as bypass: bypassPermissions (--dangerously-skip-permissions) runs everything with no checks.
• To turn it off in Claude Code: press Shift+Tab once, or set "defaultMode": "default" in ~/.claude/settings.json. Admins can set disableAutoMode in managed settings.

What is Claude auto mode?

Auto mode is the middle ground between approving every action yourself and skipping checks entirely. Anthropic's docs describe it this way: "Auto mode lets Claude execute without routine permission prompts. A separate classifier model reviews actions before they run." Explicit "ask" rules you have set still force a prompt.

Per the docs, your own allow, ask and deny rules apply first; read-only actions and file edits inside your working directory are approved automatically; everything else goes to the classifier. If it blocks an action, Claude is told why and usually tries another way or asks you. Entering auto mode also drops broad allow rules such as a blanket Bash(*), while narrow ones such as Bash(npm test) stay.

Last verified: October 25, 2026

When did auto mode become the default?

It happened in steps. The dates below come from Anthropic's posts and docs. The October 22 announcement is an update added to Anthropic's August 7 post, plus a post from its Claude account on X.

Auto mode launched on March 24, 2026, as a research preview for Team plans. Anthropic's digest for the week of May 18–22 says it reached Pro, and Anthropic's launch post notes it became generally available to all Claude Code users on July 10. The default switch was announced on August 7 and took effect on August 14.

Two details matter for the August change. Anthropic said that if you had already set a default mode yourself, it stays in place unless you accept a one-time prompt to switch, and that a default your organization manages doesn't change. It also said the classifier's own calls no longer count toward usage limits on Pro, Max and Team. The docs don't give a release date for version 2.1.283.

Some exceptions start in Manual mode even on new versions: claude -p and Agent SDK runs, sessions where a settings file sets disableAutoMode, and sessions with Anthropic's HIPAA configuration applied (from version 2.1.285). Our Claude Agent SDK guide covers what that means for apps built on the SDK.

Claude auto mode vs accept edits vs bypass permissions: what's the difference?

Claude Code has six permission modes. The configuration name for the mode that asks before most actions is default, but the app calls it "Manual."

Last verified: October 25, 2026

Auto vs accept edits. Accept edits skips prompts only for file edits and a few filesystem commands. Auto mode also runs shell commands and other tools, but screens them first.

Auto vs bypass permissions (--dangerously-skip-permissions). The flag is equivalent to --permission-mode bypassPermissions. Anthropic's docs say bypass "disables permission prompts and safety checks so tool calls execute immediately, including writes to protected paths," and warn to use it only "in isolated environments like containers, VMs, or dev containers without internet access." Deny rules still apply in bypass.

How does the auto mode classifier work?

The most detailed public description is Anthropic's engineering post of March 25, 2026, written when auto mode launched. Anthropic has changed the system since then (its changelog shows auto mode moving to a server-side classifier for API, Enterprise and cloud-provider users from version 2.1.278), so treat these details as the design at launch.

• Model: the post says the classifier ran on Sonnet 4.6.
• What it sees: only the user's messages and the agent's tool calls. Anthropic strips out Claude's own messages and tool outputs, which it calls "reasoning-blind by design," so text planted in a web page or file can't argue with the classifier directly. A separate server-side probe screens tool outputs for apparent hijacking.
• Two stages: a fast yes-or-no filter tuned to err toward blocking, then a second pass with reasoning on anything flagged.

Blocked by default, per the docs: download-and-run commands, sending sensitive data to external endpoints, production deploys, force pushes, git reset --hard, terraform destroy and merging unapproved pull requests. Allowed: local file work, installing dependencies from lock files, read-only HTTP requests and pushing to the repository you're working in.

If the classifier blocks an action three times in a row or 20 times in a session, auto mode pauses and Claude Code goes back to prompting you. Anthropic says those thresholds aren't configurable.

Is Claude auto mode safe?

Anthropic is direct that it isn't a guarantee. Its docs warn: "Auto mode reduces permission prompts but does not guarantee safety. Use it for tasks where you trust the general direction, not as a replacement for review on sensitive operations."

Its March 25 engineering post published the classifier's error rates, measured by Anthropic on its own data:

The limits are Anthropic's own: the overeager set is small (52 cases) because it "requires Claude attempting something dangerous in a real session," and the post calls the 17% miss rate "the honest number." It calls auto mode "not a drop-in replacement for careful human review on high-stakes infrastructure."

Independent researchers have also probed it. In August 2026, Johann Rehberger showed a website-borne attack leading Claude Code on Opus 5 in auto mode to run attacker code, as our prompt injection explainer describes.

Boundaries you state in chat ("don't push") aren't stored as rules, so the docs warn compaction can remove them; for a hard guarantee, write a deny rule.

How do I turn off Claude auto mode?

These steps come from Anthropic's permission-mode docs, checked October 25, 2026.

1. For one session (CLI): press Shift+Tab. From auto, the first press switches to Manual; further presses cycle Manual → acceptEdits → plan.
2. At startup: run claude --permission-mode manual (manual is an alias for default).
3. As your default: add this to ~/.claude/settings.json:

{
  "permissions": {
    "defaultMode": "default"
  }
}

4. In VS Code: click the mode indicator and pick Manual. The claudeCode.initialPermissionMode setting doesn't accept auto.
5. In Claude Code Desktop, on the web and on mobile: use the mode selector in the row under the prompt box (Desktop) or the mode dropdown next to it (claude.ai/code); in the mobile app, tap + in the prompt box, then Permission.
6. For an organization: an admin sets permissions.disableAutoMode to "disable" in managed settings. That removes auto from the Shift+Tab cycle and starts --permission-mode auto sessions in Manual. Setting permissions.disableBypassPermissionsMode to "disable" blocks bypass too.

The flag beats defaultMode in a settings file, which beats the built-in default. One trap: "auto" in a project's .claude/settings.json doesn't take effect, per the docs; set it in your user settings.

How do I enable auto mode, or turn it back on?

Press Shift+Tab until the status bar shows auto mode, start with claude --permission-mode auto, or set "defaultMode": "auto" in ~/.claude/settings.json. The docs say it needs a recent model (on the Anthropic API, Opus 4.6 or Sonnet 4.6 or later, Haiku 5.5 or a Fable model); Sonnet 4.5, Opus 4.5 and Haiku 4.5 aren't supported. Claude Code itself isn't on the free plan, as our guide to Claude's free plan explains.

What changes in the Claude apps?

In Claude's web, desktop and mobile apps, the setting appears in Cowork as three approval modes, per Anthropic's help center:

• Manually approve (formerly "Ask before acting"): Claude pauses for your approval.
• Automatically approve (auto mode): a safety check reviews each action first and blocks unsafe ones. If Claude keeps running into blocks, it goes back to asking for each step.
• Skip all approvals (formerly "Act without asking"): nothing checks Claude's actions. Anthropic says to use it only when "you completely trust every action, connector, file, app, etc. involved in the task."

You change it from the mode selector in the chat box. The help center, updated October 23, says that in the new Claude experience, which combines chat and Cowork, the message box offers "Auto (default on Pro, Max, and Team plans) and Manual (default on Enterprise plans)." On Team and Enterprise, admins control whether Automatically approve is available and whether new tasks start in it. Anthropic says Enterprise admins will get an email before auto mode becomes the default for their organizations. Claude always asks before permanently deleting files, in any mode, the help center says.

Last verified: October 25, 2026

For how Claude Code's defaults compare with Codex's sandbox presets and Cursor's run modes, see our Claude Code vs Codex vs Cursor comparison.

What's confirmed, reported and uncertain

• Confirmed (Anthropic docs and posts): the six modes and their behavior; the August 14 default for Pro, Max and Team; the version 2.1.283 default across plans and providers; how to switch and disable; the classifier design and error rates as published on March 25.
• Confirmed (Anthropic's October 22 update to its August 7 post, its Claude account on X, and the help center): the coming default for new sessions in most Claude apps on Pro, Max and Team, and Manual as the current default on Enterprise in the new Claude experience.
• Uncertain: the exact date the apps switch ("next week" from October 22 points to the week of October 26); which apps "most Claude apps" leaves out; when Enterprise app sessions follow; how much the classifier has changed since the March engineering post; the release date of version 2.1.283.