Published 14 August 2026 · Updated 19 October 2026
I’ve been warning about AI coding assistants for a while now. Most developers treat them like fancy autocomplete. They are not. They are agents that can read your files, execute commands, and push code.
Starting today, that got a lot more dangerous.
Anthropic flipped the default permission mode for Claude Code to Auto Mode for Pro, Max, and Team subscribers. The tool now approves its own commands using a two-stage classifier instead of asking you every time. The company says humans approve 93 percent of prompts anyway, so the model is just saving you the clicks.
Let me be clear: that 93 percent figure is not the reassurance Anthropic thinks it is.
Auto mode routes every tool call through a classifier that decides whether the action is safe. The company claims the controlled study found auto mode caught planted dangerous commands 89 percent of the time, compared to 13.6 percent for humans. That sounds impressive until you consider what it means in practice: roughly one in ten dangerous commands still slips through, and you will not see it coming because there is no permission prompt to stop and review.
Why this is a bigger shift than it looks
This matters enormously for enterprise development environments. Claude Code has access to your source code, your CI/CD credentials, your cloud environment variables, and your deployment pipelines. When it auto-approves a command, it is making a security decision on your behalf without waking you up.
The timing is also impossible to ignore. This change dropped just weeks after Anthropic disclosed that Claude models breached three real companies during cybersecurity tests. In those incidents, a configuration error let models that had been told they were in a simulated environment reach live production systems. Giving the same models broader autonomous control over developer machines is not a coincidence. It is the logical next step, and it should make every security team nervous.
What to do right now
The practical implications are immediate. If your organisation uses Claude Code on Pro, Max, or Team plans, every developer on those plans is now running an agent that can modify files, execute shell commands, and interact with cloud services without step-by-step approval. The main safeguard is a classifier that, in Anthropic’s own test, missed roughly one in ten planted dangerous commands.
Here is what you should do right now:
- First, audit which developers in your organisation are on Claude Code Pro, Max, or Team plans. If you do not know, assume the worst and check your expense and SaaS management systems.
- Second, require those developers to switch back to manual mode immediately. The setting is available in Claude Code’s preferences. Do not leave it on auto for shared codebases or production-connected environments.
- Third, enforce network-level controls. If Claude Code is running in your environment, restrict its outbound access to only the AI provider API endpoint. Block access to your internal git servers, Kubernetes APIs, and cloud metadata endpoints from Claude Code processes.
- Fourth, review your credential exposure. Any environment variable, SSH key, or API token readable by a developer’s machine is now potentially accessible to an autonomous agent that does not ask before using it.
The bigger picture
The broader trend is unmistakable. AI coding assistants are moving from tools that suggest code to agents that ship code. Every lab is racing to remove human approval steps because users demand speed. The security model is shifting from “ask first” to “trust the classifier.” History tells us that classifiers fail, often in ways that are obvious only after the breach.
“The organisations that survive the next twelve months are not the ones with the most AI tools. They are the ones that know exactly what AI tools they have, what those tools can touch, and whether every dependency in the chain has been verified.”
Adapted from Hudson Rock CTO Alon Gal on supply chain risk
Sources
- Anthropic, Auto mode is now the default in Claude Code for Pro, Max, and Team plans. 14 August 2026
- Anthropic Engineering, Claude Code auto mode. Source of the 93% approval and 89% vs 13.6% figures
- Backslash Security, Claude Code’s auto mode is now the default. It catches a lot, but not everything. Independent critique
- TechCrunch, Anthropic says its own AI models breached three companies during security tests. 30 July 2026
Figures are Anthropic’s. Recommendations are the author’s security guidance.
Related Reading
- AI Agent Security: A Top 10 Guide for Hermes, OpenClaw and Claude Code
- Hackers Poisoned the AI Water Supply. LiteLLM Shows How Deep the Damage Goes
The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.
How this analysis is researched, sourced and corrected: Editorial standards and corrections. Spotted an error? Contact Philip Hall.
