I’ve been warning about AI coding assistants for a while now. Most developers treat them like fancy autocomplete. They are not. They are agents that can read your files, execute commands, and push code.
Starting today, that got a lot more dangerous.
Anthropic flipped the default permission mode for Claude Code to Auto Mode for Pro, Max, and Team subscribers. The tool now approves its own commands using a two-stage classifier instead of asking you every time. The company says humans approve 93 percent of prompts anyway, so the model is just saving you the clicks.
Let me be clear: that 93 percent figure is not the reassurance Anthropic thinks it is.
Auto mode routes every tool call through a classifier that decides whether the action is safe. The company claims the controlled study found auto mode caught planted dangerous commands 89 percent of the time, compared to 13.6 percent for humans. That sounds impressive until you consider what it means in practice: roughly one in ten dangerous commands still slips through, and you will not see it coming because there is no permission prompt to stop and review.
Why this is a bigger shift than it looks
This matters enormously for enterprise development environments. Claude Code has access to your source code, your CI/CD credentials, your cloud environment variables, and your deployment pipelines. When it auto-approves a command, it is making a security decision on your behalf without waking you up.
The timing is also impossible to ignore. This change dropped just weeks after Anthropic disclosed that Claude models breached three real companies during cybersecurity tests. Those incidents happened because the models reached live production systems and kept attacking even after they realised they were not in a test environment. Giving the same models broader autonomous control over developer machines is not a coincidence. It is the logical next step, and it should make every security team nervous.
What to do right now
The practical implications are immediate. If your organisation uses Claude Code on Pro, Max, or Team plans, every developer on those plans is now running an agent that can modify files, execute shell commands, and interact with cloud services without step-by-step approval. The only safeguard is a post-hoc classifier that misses roughly one in ten risky operations.
Here is what you should do right now:
- First, audit which developers in your organisation are on Claude Code Pro, Max, or Team plans. If you do not know, assume the worst and check your expense and SaaS management systems.
- Second, require those developers to switch back to manual mode immediately. The setting is available in Claude Code’s preferences. Do not leave it on auto for shared codebases or production-connected environments.
- Third, enforce network-level controls. If Claude Code is running in your environment, restrict its outbound access to only the AI provider API endpoint. Block access to your internal git servers, Kubernetes APIs, and cloud metadata endpoints from Claude Code processes.
- Fourth, review your credential exposure. Any environment variable, SSH key, or API token readable by a developer’s machine is now potentially accessible to an autonomous agent that does not ask before using it.
The bigger picture
The broader trend is unmistakable. AI coding assistants are moving from tools that suggest code to agents that ship code. Every lab is racing to remove human approval steps because users demand speed. The security model is shifting from “ask first” to “trust the classifier.” History tells us that classifiers fail, often in ways that are obvious only after the breach.
“The organisations that survive the next twelve months are not the ones with the most AI tools. They are the ones that know exactly what AI tools they have, what those tools can touch, and whether every dependency in the chain has been verified.”
Adapted from Hudson Rock CTO Alon Gal on supply chain risk
