Claude Code Auto Mode: The "Allow" Button Was Never Protecting You

Anthropic is switching Claude Code to Auto Mode by default, and to me this is one of the biggest developer stories of the past few days. The change itself: the agent acts without constant permission prompts, and before each tool call a separate classifier decides whether the action is destructive, outside the scope of the task, or the result of a prompt injection.

The change has sparked a heated debate, and a lot of the reaction is negative. As I see it, the whole argument boils down to one question: are we ready to trust an agent with the terminal. But I think that framing is wrong. We already trust it. What changed is not the level of trust — it is who is accountable for it.

The numbers that explain everything

The most interesting part of the announcement is not the feature but the data Anthropic uses to justify it. According to the research being discussed, the classifier blocked about 89% of dangerous actions. Humans approving manually blocked 13.6%. And that is not even the worst case: as requests pile up, human approval degrades further due to approval fatigue.

Anthropic has long pointed to exactly this as the problem with the perpetual "Allow": in practice, users approve about 93% of requests almost automatically. A confirmation dialog you click through nine times out of ten without looking is not control. It is a ritual of control. It creates the feeling of safety without creating safety — while faithfully eating the agent's main advantage: the ability to work while you are busy with something else.

Accept those numbers and the conclusion is uncomfortable but direct: replacing the human approver with a classifier is not lowering the security bar. It is raising it. From 13.6% to 89%.

What this actually means

Formally, nothing revolutionary happened. Coding agents have been running autonomously for a long time — simply because users have been mass-enabling the equivalents of --dangerously-skip-permissions. A flag with a self-explanatory name that people turn on because working any other way is impossible.

The real difference is the shift in responsibility. It is one thing to have "a dangerous flag you enabled at your own risk," and quite another to have a default, first-class UX the vendor stakes its name on. Until now, autonomy was effectively the user's fault; now it becomes Anthropic's position.

To me this event matters more than another bump on SWE-bench. Benchmarks measure how well an agent writes code. What is changing here is the working model itself: coding agents are moving along the path "assistant → supervised agent → semi-autonomous worker," and Auto Mode by default is an official acknowledgment that the industry is already on the third step. Not "the model got smarter" but "the model is now expected to work unsupervised."

I see nothing frightening in this logic — my work with agents was never built on the "Allow" button in the first place, but on boundaries written into the project itself: a spec the code can cite, rules that record expensive mistakes, tests on the critical spots, and diff review. The confirmation button was never a real line of defense in that setup — the 93% figure merely confirms what everyone who works with agents knows from experience.

A classifier is not a sandbox

That said, it is important to call things by their names: a classifier is not a sandbox and not a formal security guarantee. It is a probabilistic model that catches 89% of dangerous actions. The remaining 11% have not gone anywhere — and prompt injection as a class of attacks is specifically designed to hunt for exactly those gaps.

The difference is fundamental. A sandbox is a boundary defined by a mechanism: whatever the agent decides, it physically cannot get outside the container, the VM, or the restricted user. A classifier is a boundary defined by a prediction: a dangerous action will most likely be stopped. "Most likely" is not the level of guarantee you build on when production credentials and other people's data are involved.

So for serious work my position does not change: an isolated environment remains the last line of defense. The classifier is a good middle line — it catches the vast majority of problems cheaply and without friction. But the last line has to be mechanical, not statistical: a separate environment, restricted credentials, no direct access to anything you cannot afford to lose.

The bottom line

Auto Mode by default is the right move, backed by honest and uncomfortable data: a human with an "Allow" button protects worse than a classifier, and everyone has known it for a long time. But the right move does not cancel the main rule of working with autonomous agents: trust is configured not by a confirmation dialog and not by a classifier, but by architecture — by what the agent can physically reach. Anthropic removed the ritual. The real boundaries are still on us.