Claude Code Stops Asking Permission on August 14. Here Is What It Still Will Not Catch.
- Branden Bell
- Aug 13
- 4 min read
On August 14, Claude Code starts new sessions in auto mode by default for anyone on a Pro, Max, or Team plan. Instead of stopping to ask you to approve each action, it runs, and a separate classifier model checks each action before it happens.
I should admit something before I go further. For months I clicked approve on those prompts without reading them. Glance, approve, keep going, because the box had shown up for the two hundredth time that afternoon and it was almost always fine.
Anthropic has a number for that behavior and it's worse than I'd have guessed.
The data behind the change
Users approve 97% of permission prompts in Claude Code. When Claude puts a whole plan up for approval instead, people reject 39% of them. So the reviewing instinct is intact, it just doesn't fire on a small box that keeps appearing.
Then Anthropic ran a test. They hired 1,053 paid testers, swapped a single permission prompt in each session for a clearly dangerous command, and recorded who caught it.
The testers caught it 13.6% of the time. Auto mode caught 89% of the same commands. Head to head, auto mode blocked 800 commands that a human had waved through, and humans blocked 6 that auto mode allowed.
The part I keep thinking about is what happened as sessions ran longer. Early on, testers blocked about 17% of the dangerous commands. After fifty or more prior prompts, that fell to about 5%. The classifier's rate never moved.
After fifty or more prompts, testers were catching about 5% of dangerous commands. The classifier stayed flat.
What actually flips on the 14th
If you're on Pro, Max, or Team, here's what changes:
New sessions start in auto mode: the routine approval prompts stop, and a classifier reviews each action instead.
You can switch back whenever you want: Shift+Tab in the CLI, or the mode dropdown in the desktop app.
A pinned default gets left alone: if you'd already set a different one, you may get a one-time prompt asking whether you want to switch.
It stays opt-in elsewhere for now: Claude Enterprise, the Claude API and the cloud partner platforms keep it optional, and Anthropic says it plans to make it the default there in the coming month.
The classifier tokens are no longer billed: Anthropic stopped charging Pro, Max and Team users for that overhead.
There's a circuit breaker too. Three blocks in a row, or twenty across a session, and Claude Code drops back to manual approvals.
The three words that define the whole thing
The classifier is aimed at actions that are irreversible, destructive, or aimed outside your environment. Those three categories are the entire safety boundary, and they're worth reading slowly if you're paying someone to build you a Claude system rather than writing one yourself.
Publishing a page that misstates your pricing isn't any of the three. Sending a client email in a voice that isn't yours isn't either. A blog post going out with a number nobody checked is reversible, not destructive, and entirely inside your environment.
Those actions look exactly like the work you asked for, because structurally that's what they are. A classifier that stopped them would stop everything.
The page I lost
I had Claude rebuild my own website page by page in the Wix editor. Partway through, a finished About page got silently destroyed.
Nothing looked wrong while it was happening. Every edit verified as landed. What actually went on is that the editor's focus quietly drifted to a different page mid-batch, and three removal calls ran against the wrong container. The page published empty. The check that ran right after came back clean, because an empty page has no defects left in it to find.
Now run that against the three categories. Writing text into a container isn't destructive. It isn't aimed outside my environment. It's the most ordinary thing a page builder does all day, and nothing in a safety classifier is looking for it.
The fix was a guard that re-checks which page has focus immediately before every single write instead of once per batch. That rule is a permanent part of the Wix rebuild skill, which is a free download with no email. The failure is written up on the same page.
Where the other guardrails have to live
The rules that keep a Claude system from embarrassing you aren't Anthropic's to write. They go inside the system itself.
The brand kit skill is the clearest example I've got. It won't write a file that breaks its own standards. Body text has to clear a 7:1 contrast ratio. A positioning line over 175 characters gets rewritten instead of shrunk down to fit. A headline whose letters fall apart at display size gets caught before it ships.
Anthropic's classifier is watching for damage, and it was never built to watch for output I wouldn't put my name on.
A classifier that stopped ordinary work would stop everything. That's why it can't be the thing protecting your brand.
What I'd ask before someone builds you one
Four questions, and I'd want real answers to all of them:
What does this system refuse to do? If the answer is nothing, it doesn't have guardrails, it has instructions.
What happens when a step half-succeeds? The failures that cost you are rarely loud. They verify clean and look finished.
How does it check its own output before anything reaches a customer? A review pass isn't optional on anything published under your name.
Which permission mode is this meant to run in, and why? Auto mode being the default doesn't make it the right answer for every job. Anthropic still recommends reviewing Claude's actions yourself for high-stakes changes to production infrastructure.
There's a separate set of questions worth asking about what a build costs and whose account it runs in when it's done.
I ask myself the same four now, and I only have the list because I got them wrong first.
Sources
Checked August 2026:
If you've already got Claude doing real work in your business, do you know what it refuses to do? I'm honestly curious what people answer.
If you'd rather talk it through, the intro call is free and runs fifteen to twenty minutes. Please pick any time that works for you.
Comments