Humans Caught 13.6% of Dangerous Commands. Auto Mode Caught 89%.
On August 14, auto mode becomes the default in Claude Code for Pro, Max, and Team. The number that justifies it also indicts the thing it replaces: users approve 97% of permission prompts.
NeuroX AI · August 11, 2026
Starting August 14, new Claude Code sessions on Pro, Max, and Team plans run in auto mode — no permission prompt per tool call, just a classifier blocking anything irreversible, destructive, or aimed outside your environment. The number carrying the decision: in a controlled study of 1,053 paid testers, human review caught 13.6% of dangerous commands while auto mode caught 89%.
Anthropic didn't assert approval fatigue, it measured it. Users approve 97% of permission prompts. They reject 39% of plan proposals but only 3% of individual permission requests — meaning people still think at the plan level and have stopped thinking at the command level. 62% have reached for bypassPermissions at least once. The click was never a control. It was a formality your team performed on the way to yes.
The outcome data holds up: 6.3% of manually approved sessions contained harmful unintended actions, versus 2.4% under auto mode, and auto mode users ship about 25% more PRs. There's a circuit breaker too — three consecutive blocks, or twenty across a session, and it falls back to manual approvals.
Now read the other 11%. A classifier is a control, not the control. What catches the rest is the environment you put the agent in: scoped credentials, an isolated worktree, a revertible git state, a spend cap. Enterprise, API, Bedrock, and Vertex stay opt-in, so admins get a window. Use it to build the floor, not to postpone the default.