News · 2026-08-08

Claude Code stops asking permission on August 14

Starting 14 August 2026, Claude Code will stop asking permission before it acts. Anthropic is making "auto mode" the default permission mode for new sessions on its Pro, Max, and Team plans, replacing per-action approval prompts with a separate classifier model that reviews each action before it runs. The company's own documentation describes that classifier's job in explicitly adversarial terms: it blocks anything "that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read."

Key facts

• Date: 14 August 2026, for new sessions on Pro, Max, and Team plans. Existing defaults you set yourself stay in place unless you accept a one-time switch prompt.
• Mechanism: a separate classifier model vets every action before execution, rather than a static allowlist.
• Guardrail: since Claude Code v2.1.142, a checked-in repository setting cannot switch auto mode on -- the flag is only honoured from the user's own home-directory settings.
• Primary source: Anthropic's Claude Code permission modes documentation and its announcement post.

The last clause of that classifier description is the whole security story. "Hostile content Claude read" means prompt injection: text planted in a file, a web page, an issue tracker, or a dependency's README that instructs the agent to do something its user never asked for. Coding agents are unusually exposed to it, because reading untrusted text is most of what they do all day. An agent that reads a repository has, by definition, read whatever an attacker put in that repository.

Until now the industry's answer was to make the human the classifier: show a prompt before each command and let the operator catch the weird one. That works until it doesn't, which is roughly the fiftieth prompt of a long session. The well-documented failure is prompt fatigue -- people approve by reflex, or they reach for the escape hatch and run the agent with permissions disabled entirely, which removes the check rather than automating it.

Anthropic's bet is that a second model, one that never gets bored, is a better reviewer than a tired human clicking yes. The classifier is a separate call, so it is not the same context that read the poisoned file; it is asked a narrow question about whether a proposed action fits the user's stated intent. Think of it as a second signature on a wire transfer: the person who received the payment instruction is not the person who approves it.

The mechanics matter as much as the concept. Explicit ask rules set by the user still force a prompt regardless of what the classifier thinks. The classifier also adjudicates destructive filesystem operations targeting the root or home directory -- commands in the shape of rm -rf / and rm -rf ~ -- including when the dangerous path is hidden inside command or process substitution, a case the docs note was handled differently in versions before 2.1.218. Administrators on Team and Enterprise plans can switch the whole thing off for their organisation by setting permissions.disableAutoMode to disable in managed settings.

The most interesting line in the documentation is the quietest one. Claude Code v2.1.142 and later ignore an auto default when it appears in a project's .claude/settings.json or .claude/settings.local.json, and the docs give the reason plainly: "so a repository cannot grant itself auto mode." That is a supply-chain control. Without it, cloning a hostile repository would be enough to hand its author an unprompted agent on your machine -- the configuration file itself becomes the exploit. Anthropic moved the privilege decision up to the user's home directory, where a downloaded project cannot reach it. It is the same instinct behind sandboxing agents generally: assume the working directory is enemy territory.

Anthropic is notably unwilling to oversell it. The documentation carries a warning in its own voice: "Auto mode reduces permission prompts but does not guarantee safety. Use it for tasks where you trust the general direction, not as a replacement for review on sensitive operations." Auto mode is also gated on capable models -- Opus 4.6 or later, Sonnet 4.6 or later, or Fable 5 on the Anthropic API, with a narrower list on Bedrock, Google Cloud's Agent Platform and Microsoft Foundry. Older models are not supported anywhere, which is a tacit admission that the classifier's judgement is the load-bearing part.

Why it matters: this is the first time a major vendor has made unprompted execution the default for a general-purpose coding agent, and it relocates the trust boundary. Approval used to be a human act at the point of execution. Now it is a model's inference about intent, made in a few hundred milliseconds, on behalf of a user who may not be watching. That is a reasonable trade -- the alternative in practice was people disabling permissions wholesale -- but it makes the classifier a high-value target. Every published agent failure of the past year, from agents smuggling messages through directory names to Uber's watcher catching hundreds of credential exposures across its fleet, has been a story about an agent doing something technically permitted and obviously unintended. A classifier is a much better filter than a prompt. It is still a filter, and filters get studied by the people trying to get past them.

The honest caveat: there is no published evaluation of how often the classifier is right. Anthropic has not released false-negative rates, an adversarial test set, or an accounting of what an injected instruction has to look like to slip through. Until someone does that work -- and red-teaming it is the obvious next move for security researchers -- the security claim rests on the vendor's own description of its behaviour.

Primary source, verified: read the paper →

Ground Truth. (2026, August 8). Claude Code stops asking permission on August 14. Ground Truth. https://groundtruth.day/news/claude-code-stops-asking-permission-on-august-14.html

@misc{groundtruth:claude-code-stops-asking-permission-on-august-14,
  title  = {Claude Code stops asking permission on August 14},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {aug},
  url    = {https://groundtruth.day/news/claude-code-stops-asking-permission-on-august-14.html}
}

Topics: cybersecurity · prompt-injection · ai-security · agents · supply-chain · anthropic