An update dated October 22, 2026, on Anthropic's auto-mode article says auto mode will roll out next week as the default for new sessions in most Claude apps on Pro, Max, and Team plans. Safe actions proceed. Risky ones are blocked while Claude looks for another route. Enterprise administrators get an email before auto mode becomes the default for their organizations. The same note says the research figures below are specifically for Claude Code.
[1]
The earlier text says that starting August 14, new Claude Code sessions on Pro, Max, and Team plans run in auto mode. Someone who already chose a different default may see a one-time prompt about switching. A pinned default stays as it is. The page also says the classifier uses a small number of extra tokens per tool call, and that Claude Code users on those plans are no longer charged for that overhead, effective the day that sentence was written. That sentence sits in the article above the October 22 update, so it should not be redated to October 22.
[1]The chart in the article is titled as harmful actions caught: 13.6 percent for human review and 89 percent for auto mode. The prose gives the counts. Anthropic hired 1,053 paid testers and put them in an environment built for the study, not in their own codebases and not on real projects. Participants knew they were being evaluated and were not told which behavior was being measured. Partway through a session, one permission prompt was swapped for a clearly dangerous command. The page says approving that prompt never ran anything dangerous. Only the text of the prompt changed.
[1]Human reviewers caught the dangerous command 13.6 percent of the time, 143 of 1,053. Auto mode blocked 89 percent of the same commands, 937 of 1,053. Head to head, auto mode blocked 800 commands a human approved, and humans blocked 6 that auto mode allowed. As sessions grew longer, humans did worse: about 17 percent early in a session, and about 5 percent after 50 or more prior prompts. Auto mode's block rate stayed flat as sessions lengthened. Those are the study results as the page states them.
[1]The page also says that among Teams and Enterprise adopters, auto mode users ship about 25 percent more pull requests. That is a comparison among adopters, not a result the page presents as an experiment on every user. In a third-party evaluation, none of 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode. The same evaluation reports a 5.83 percent attack success rate for GPT-5.6 Sol in Codex Auto-review mode, and 19.03 percent in Full Access mode. The page does not describe how those attacks were built.
[1]