Auto mode by default: why approve-every-step was security theatre

Anthropic announced on August 9 that from August 14 auto mode is the default in Claude Code for Pro, Max, and Team accounts. In auto mode the agent does not ask for approval at each step; it keeps going unless the action is "irreversible, destructive, or aimed outside your environment." The test build has been running since March 2026. The number that justifies the change is the one I want to argue about, because I think it is right and I think most teams will draw the wrong conclusion from it.

The numbers Anthropic published

• In a test with 1,053 paying testers, auto mode caught 89% of harmful actions.
• Manual per-step review caught 13.6%.
• Users approve 97% of prompts without reading them.

Read those together. The approval dialog was not a control. It was a reflex. If 97 out of 100 clicks are blind, the human in the loop is a rubber stamp with a latency cost, and the 13.6% catch rate is what a rubber stamp achieves. A classifier that looks at every action and blocks the irreversible, destructive, or externally aimed ones caught more than six times as much. That is not a claim that the model is safer than a person. It is a claim that an attentive machine beats an inattentive person, which should surprise nobody who has approved a hundred npm install prompts in an afternoon.

Approve-every-step never protected your repository. It protected your feeling of being in charge, and it charged you a click per feeling.

What actually moves

The security boundary moves from a human click to three things: the action classification (irreversible, destructive, outside the environment), prompt-injection screening on what the agent reads, and hard deny rules you write. Anthropic's framing is human-on-the-loop rather than human-in-the-loop. That is the correct architecture and it is also more work, because the work moves from your thumb to your configuration.

The same shift happened on the other side of the fence. OpenAI's Codex approval modes went through the same progression toward autonomy with a sandbox, and the lesson there was identical: the useful control is the sandbox and the deny list, not the prompt.

The policy to write before August 14

Do this before the flip lands, not after the first surprising force push.

• List the irreversible operations in each project. Deploys, database migrations, deletion of data or branches, anything that sends email or money. Write them down; you cannot deny what you have not named.
• Write hard deny rules for that list and keep a human gate on them. Auto mode's classifier is a default, not your policy.
• Turn on prompt-injection screening for anything the agent reads from outside the repository: web pages, issue comments, third-party package READMEs.
• Isolate the working tree. Git worktrees or a container, so an autonomous run cannot touch the checkout you are editing. My notes on sandboxing coding agents cover the container side.
• Keep an audit log you will actually read: the actions, the ones the classifier blocked, and the ones a human overrode. Sample it weekly.
• For client repositories, publish the auto-mode policy as a file in the repo: deny list, audit location, review gate for production. Make it a checked-in artifact, not tribal knowledge.

Where the argument gets uncomfortable

The 89% figure is a catch rate on Anthropic's own definition of harmful, in its own test population. Eleven percent of harmful actions got through, and in an autonomous loop those are the ones that run to completion. Manual review at 13.6% is worse, but a team that was already using deny rules, worktrees, and a sandbox was never relying on the click. For them the flip is a productivity change, not a safety change. For a team that had none of that and trusted the dialog, the flip removes the only control they had, and the right response is to build the real ones this week.

The honest gap

Every number here is Anthropic's, from a test whose protocol I have not seen. "Harmful action" is not defined in the announcement, the 1,053 testers were self-selected paying users, and 89% tells you nothing about the severity of the 11%. I believe the direction. I would not put the specific percentages in a client deck without the caveat.