Claude Code makes auto mode the default on August 14: what changes

Short answer: starting August 14, 2026, auto mode becomes the default permission mode for new Claude Code sessions on the Pro, Max and Team plans, which means Claude Code stops asking you to approve routine actions and a separate classifier model reviews them instead. Anthropic's documentation states that a default you set yourself stays in place unless you accept the one time switch prompt, and that a default your organization manages is unchanged. You can switch modes at any time.

What exactly changes in Claude Code on August 14, 2026?

One thing changes: the mode a new session starts in. Until now, a new Claude Code session started in Manual mode, whose config value is default, where only reads run without a prompt and every file edit or shell command pauses for your approval. From August 14, new sessions on Pro, Max and Team start in auto instead, described in the official mode table as running "Everything, with background safety checks". The change is documented in the Claude Code release digest for the week of August 3 to 7, 2026 and in the permission modes reference, both read on August 11, 2026.

Three details decide whether this touches you at all. If you already set defaultMode yourself, your setting survives the switch unless you accept a one time prompt offering to change it. If your organization manages the default, nothing changes. And the same digest notes something already in effect on those plans: the classifier calls that auto mode makes no longer count toward your usage limits, so the extra safety check is not billed against your quota on Pro, Max and Team.

What does auto mode in Claude Code still block?

Auto mode is not an open door. Every action that is not a read or a working directory edit goes to a separate classifier model, which the documentation says blocks anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read. The published block list is long and specific: downloading and executing code such as curl | bash, production deploys and migrations, force push, granting IAM or repository permissions, terraform destroy and its Pulumi, CDK and Terragrunt equivalents, git reset --hard and the other commands the classifier presumes would discard uncommitted work, printing a live credential into the transcript or a file, and removals aimed at the filesystem root or your home directory.

We counted the categories on that page on August 11, 2026, and the count says something the list alone does not: there are more than thirty distinct block categories, and roughly two thirds of them are marked as added in Claude Code version 2.1.195 or later. That is our reading, and you can repeat it on the same page. The practical consequence matters more than the number: auto mode as it behaved a few versions ago is not auto mode today, so advice about it written even a month back is describing different software. You can print the current rule lists yourself as JSON by running claude auto-mode defaults.

What does Claude Code approve without asking in auto mode?

The allow list is where the day to day feel of auto mode comes from, and it is worth reading before you decide how you feel about the switch. Claude Code auto approves local file operations in your working directory, installing dependencies declared in your lock files or manifests, read only HTTP requests, reading .env and sending those credentials to their matching API, and pushing to any branch of the repository you are working in, including the default branch. Creating a pull request that matches what you asked for also runs without a prompt.

Two carve outs sit inside that last item and they are easy to miss. A non default branch whose name marks it as a deploy or publication target, such as production or gh-pages, is not covered by the blanket push allowance and gets judged on its own terms. And the content of any push is still checked against every other rule, so an allowed destination does not make a secret bearing commit allowed. If you want a human checkpoint before pushes or pull requests while staying in auto mode, the documented route is adding permissions.ask rules rather than leaving the mode.

Is auto mode the same as running Claude Code with --dangerously-skip-permissions?

No, and the distinction is the single most useful thing to take from this article, because the two get discussed as if they were the same shortcut. The flag --dangerously-skip-permissions puts Claude Code into bypassPermissions mode, whose row in the official mode table reads "Everything" under what runs without asking and "Isolated containers and VMs only" under what it is for. There is no classifier in that path, while auto mode keeps a review step in front of every action that is not a read. Both can be set as a starting mode through permissions.defaultMode in settings, so the difference is not that one is configurable and the other is not. The difference that matters on August 14 is which one arrives on its own: auto mode is the one becoming the starting mode for everyone on Pro, Max and Team, and bypass stays something you have to reach for deliberately.

There is a detail that makes the difference concrete rather than philosophical: launching an autonomous agent loop that runs without human approval or a sandbox, with --dangerously-skip-permissions named in the documentation as the example, is itself on auto mode's block list. Auto mode will stop Claude from starting the very thing that skips permissions. Entering auto mode also drops broad allow rules that grant arbitrary code execution, including blanket Bash(*), wildcarded interpreters such as Bash(python*) and package manager run commands, while narrow rules like Bash(npm test) carry over. Those dropped rules come back when you leave the mode. This question is being asked in public right now: a thread titled simply "Dangerously skip permissions" was posted to r/ClaudeAI on August 10, 2026, and one titled "Sandboxing & Powerusers: How to maintain productivity without losing security?" on August 6, 2026.

How do you keep manual approval in Claude Code after August 14?

Set the default yourself, in the right file. Manual mode is the one that reviews every action, it is labelled Manual in the CLI and in the VS Code, JetBrains and desktop interfaces, and its config value is default, with manual accepted as an alias from Claude Code version 2.1.200 onward. Putting {"permissions": {"defaultMode": "manual"}} in your user settings file at ~/.claude/settings.json is what makes new sessions keep starting there, and the documentation is explicit that a default you set yourself survives the August 14 switch unless you accept the one time prompt.

Mid session, pressing Shift+Tab cycles through the modes and the status bar shows which one is active, with Manual displayed as a gray manual mode on badge. One asymmetry is worth knowing if you administer machines: defaultMode: "auto" is ignored when it appears in a project's .claude/settings.json or .claude/settings.local.json, deliberately, so that a repository you clone cannot grant itself auto mode. It only counts from your own user settings. On Team and Enterprise plans an administrator can remove the mode entirely by setting permissions.disableAutoMode to disable in managed settings.

Can you stop Claude Code from reading your secrets files?

This is the question a developer put to r/ClaudeCode on August 10, 2026 under the title "Do you block Claude Code from reading your secrets files?", and the documentation answers it in a way that surprises people in both directions. Reading .env and sending those credentials to their matching API is on the allow list, so auto mode will not stop it. But printing a live credential into the transcript or a file is blocked, and from version 2.1.203 content from a sensitive local store, or from a file whose name, path or type marks it as sensitive, is blocked from entering a commit, a push, pull request or issue text, a gist or a package publish unless you named both the source and the destination. Session transcripts, SSH keys, cloud credential folders, browser profiles and shell history all count, and the repository being private does not clear the block.

If you want a hard guarantee rather than a classifier judgment, the documented instrument is a deny rule. Rules in permissions.deny apply in every mode, including bypassPermissions, which no mode setting can override. The same page makes a related point that is easy to get wrong: a boundary you state in conversation, such as telling Claude not to push, is treated by the classifier as a block signal and stays in force until you lift it, but it is not stored as a rule. The classifier rereads it from the transcript on every check, so context compaction removing that message can lose it. A boundary you actually depend on belongs in a deny rule, not in a sentence.

What happens when the classifier blocks too much?

Claude Code has a documented fallback, and knowing the numbers keeps you from thinking the tool broke. If the classifier blocks an action three times in a row, or twenty times in total, auto mode pauses and Claude Code goes back to prompting you. Approving the prompted action resumes auto mode. Those thresholds are not configurable. Any allowed action resets the consecutive counter, while the total counter persists for the session. In non interactive runs with the -p flag there is nobody to prompt, so repeated blocks abort the session instead.

Each denied action shows a notification and lands in /permissions under a Recently denied tab, where pressing r retries it with a manual approval. Worth setting expectations on one point: in most sessions, from version 2.1.208 onward, the reason Claude receives is the fixed text Blocked by classifier rather than a written explanation, so the agent cannot always tell you why it was stopped. The documentation reads repeated blocks as the classifier missing context about your infrastructure, and points administrators at trusted repository, bucket and service entries to fix it at the source.

What does this change for people running several AI coding agents at once?

It changes the shape of your attention, which is the part nobody warns you about. A permission prompt is an interruption, but it is also a checkpoint, and it arrives per agent. Remove routine prompts from four sessions at the same time and all four run further before you look at any of them. That is the point of the mode and it is also the new risk: the work between checkpoints got longer, so review has to absorb what approval used to catch. Our own guide to reviewing code written by multiple AI agents argues for starting with what the change should not have touched, and that habit gets more valuable, not less, once the approvals stop arriving.

Two documented behaviours matter specifically for multi agent work. Subagents are checked by the classifier at three points, before the subagent starts, on each of its own actions, and again on its full action history when it finishes, and a permissionMode declared in a subagent's frontmatter is ignored, so a subagent cannot loosen the rules the parent session is under. And auto mode nudges Claude to keep working rather than stopping to ask clarifying questions, which compounds across parallel sessions. CanvasCode, the Mac app that runs the official agent CLIs side by side on one canvas, is built for exactly this arrangement, and our honest read is that the switch makes a per agent view of state more useful than a prompt count ever was.

Two limitations we will not paper over. First, Anthropic's own documentation carries a warning that auto mode reduces permission prompts but does not guarantee safety, and recommends it for tasks where you trust the general direction rather than as a replacement for review on sensitive operations, which is a caveat from the vendor, not from a skeptic. Second, everything above describes published rules read on August 11, 2026, three days before the switch takes effect, and we have not measured how the classifier behaves across a working week on a real repository, including how often it produces a false block. On Enterprise plans and on API, Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform and Microsoft Foundry accounts, classifier calls do count toward token usage, unlike on Pro, Max and Team. If your reason to care about session weight is cost, our note on when to run /clear instead of /compact covers that side.