Starting next week, Claude stops asking for permission by default. Anthropic said on Thursday, October 22, that new sessions in its Claude apps will run in auto mode on Pro, Max and Team plans, replacing the approve-every-step prompts with an automated safety check. “Rather than asking you to approve each step, an automated check blocks risky actions,” the company wrote on X. You can switch back to manual approvals whenever you want.
Claude auto mode isn’t new. It has been the default in Claude Code, Anthropic’s coding agent, since August, and Anthropic is leaning on that rollout’s data to argue that a classifier catches more dangerous actions than a tired human clicking “Allow.” What changes now is the audience: everyday Claude users whose tasks touch email, files, browsers and connected apps.
- Price: no extra charge. Auto mode is a default setting on plans you already pay for: Claude Pro ($20 a month, or $17 a month billed annually), Max (from $100 a month) and Team.
- Availability: rolling out next week for new sessions in “most Claude apps,” per Anthropic. Enterprise admins get an email before it becomes their default. The free plan isn’t part of the change.
- The catch: it’s a classifier, and Anthropic says it “does not eliminate risk.” Its safety numbers come from Anthropic’s own Claude Code testing, not from the apps.
What changes in the Claude apps next week
Claude’s apps give you three ways to handle actions, according to Anthropic’s Help Center. Manual (formerly “Ask before acting”) pauses for your Allow or Deny on each step. Auto lets Claude keep going while it reviews each action for safety, checking for things like data exfiltration and prompt injection, and blocks what it judges unsafe. Skip (formerly “Act without asking”) runs with no checks at all, and Anthropic says to use it only when you completely trust everything involved.
That’s a reversal. When Anthropic merged Cowork and chat into one Claude app in September, its announcement said that “by default, Claude asks before taking an action.” From next week, Auto is the starting point for new sessions instead. The Help Center says Auto covers your connectors, plugins, the built-in browser, Claude in Chrome and some Cowork actions like fetching websites.
The wording varies slightly between Anthropic’s channels. The X post says web, desktop and mobile. The updated blog post says “most Claude apps” and doesn’t name the ones left out, or give an exact day.
How the auto mode check decides
In Claude Code, Anthropic routes each tool call through a classifier aimed at actions that are “irreversible, destructive, or aimed outside your environment,” according to its auto mode post. When something is blocked, Claude usually looks for a safer route or asks you directly. If it keeps hitting walls, three blocks in a row or twenty in a session, Claude Code drops back to manual approvals. Anthropic hasn’t said whether the apps use the same thresholds.
Some guardrails stay on regardless. Anthropic’s safety guide says Claude asks for explicit permission before permanently deleting files, and on Team and Enterprise plans an admin decides whether Auto is offered at all and whether new tasks start in it.
Anthropic’s case: people click “Allow” on autopilot
Anthropic’s argument rests on how people actually behave. In Claude Code, the company says, users approve 97% of permission prompts. They reject 39% of plans Claude proposes, but only 3% of individual permission requests, which Anthropic reads as people clicking through rather than reviewing.
The headline claim comes from a controlled study with 1,053 paid testers working in a test environment set up for the study. Anthropic says human review caught 13.6% of dangerous commands, while auto mode caught 89%. Humans also got worse as sessions dragged on, blocking about 17% of dangerous commands early and about 5% after 50 or more prompts.
The numbers behind the switch, and their limits
Anthropic also points to real Claude Code sessions it flagged between May and June. At what it calls production-level severity, 6.3% of manually approved sessions contained a harmful action the user hadn’t asked for, compared with 2.4% of auto mode sessions. Red-teaming with Apollo Research, a UK AI safety startup, cut the classifier’s miss rate from 12% to 7% on synthetic attacks. In a prompt-injection test by Trajectory Labs, which Anthropic commissioned, none of 720 attacks succeeded against Claude models in auto mode, versus 5.83% against OpenAI’s GPT-5.6 Sol in Codex’s Auto-review mode. The test ran in July, and Anthropic’s own footnote says a newer version of OpenAI’s Auto-review “could change the results.”
All of these are company claims about a coding tool. None of them measures the consumer apps, where the risky actions look different: sending an email as you, buying something, editing a shared document. Anthropic’s Help Center makes the same point in plainer words, telling users to stay close for work involving “money, messages sent as you, important files.” Its auto mode post adds that for high-stakes production changes, you should still review Claude’s actions yourself.
One open question is cost. Anthropic stopped charging Claude Code users on Pro, Max and Team for the classifier’s extra tokens in August. Its October update doesn’t say whether the check counts against usage limits in the apps.
How to turn Claude auto mode off
Pick Manual in the mode selector of the Claude message box, and Claude goes back to asking before each action. In Claude Code, Shift+Tab cycles modes in the terminal, and the desktop app has a mode dropdown. Admins can pin an organization-wide default with the defaultMode managed setting or remove auto mode entirely with disableAutoMode. Auto mode stays opt-in for now on the Claude API and cloud platforms such as Amazon Bedrock and Microsoft Foundry, Anthropic says.
What to watch next
The rollout starts next week, so check whether your next new session opens in Auto, and whether Anthropic names the apps that are excluded. Enterprise customers should watch for the admin email. The bigger test is whether a classifier trained on coding mistakes holds up when Claude is booking, buying and emailing on your behalf. We’ll update this story when Anthropic publishes app-specific details.
Frequently asked questions
Is Claude auto mode on by default?
It will be for new sessions. Anthropic says auto mode rolls out next week as the default in most Claude apps on Pro, Max and Team plans. In Claude Code it has been the default on those plans since August.
How do I switch Claude back to manual approvals?
Choose Manual in the mode selector in the Claude message box. Anthropic used to call this mode Ask before acting. Claude will then pause for your Allow or Deny before each action. In Claude Code, press Shift+Tab or use the desktop mode dropdown.
What does Claude auto mode block?
Anthropic says the check reviews each action and blocks ones it judges unsafe, such as data exfiltration or prompt-injection attempts. In Claude Code it targets actions that are irreversible, destructive or aimed outside your environment. Claude still asks before permanently deleting files.
Does the change apply to Enterprise plans and the API?
Not right away. Anthropic says Enterprise admins will get an email before auto mode becomes their organization’s default, and admins can turn it off. Auto mode remains opt-in on the Claude API and cloud platforms.
Sources
- Anthropic (Claude), “Auto mode is now the default in Claude Code for Pro, Max, and Team plans” (August 7, 2026, with “Update, October 22, 2026” on the apps rollout; classifier, fallback thresholds, 1,053-tester study, flagged-session analysis, Apollo Research and Trajectory Labs results, classifier overhead, admin settings, “does not eliminate risk”): claude.com/resources/articles/auto-mode-default-in-claude-code
- @claudeai on X, auto mode default announcement (October 22, 2026, 4:04 PM ET): x.com/claudeai/status/2113360845409583307
- Claude Help Center, “Get started with Claude Cowork” (Manual, Auto and Skip modes; what Auto covers; Team and Enterprise admin controls): support.claude.com
- Claude Help Center, “Use Claude Cowork safely” (deletion protection): support.claude.com
- Anthropic (Claude), “Cowork and chat are now one Claude” (September 16, 2026; previous ask-first default): claude.com/resources/articles/cowork-is-now-claude
- Claude, Pricing (Pro $20 monthly or $17 a month billed annually; Max from $100 a month): claude.com/pricing
- Claude on YouTube, “How auto mode works with Claude Code” (August 4, 2026): youtube.com/watch?v=b8SV4U6fEIc
All sources accessed October 23, 2026, between about 8:00 and 8:50 AM ET.
Last updated: October 23, 2026. To report an error, see our corrections page. Articles are drafted with AI assistance and reviewed and edited by an editor; see our editorial policy.
