What's this about?
Starting August 14, Claude Code's "Auto mode" becomes the default for Pro, Max, and Team users. In Auto mode the coding agent runs its tools — editing files, running commands — without stopping to ask permission at each step. Anthropic's argument is counterintuitive: this is *safer*, not riskier, because when people are asked to approve every action they quickly start rubber-stamping, so the prompts become theater. Instead they lean on layered defenses, and engineers say they've used Auto mode exclusively for months.
What is a "permission prompt" and why remove it?
When an AI agent wants to do something with real consequences — run a shell command, delete a file, hit an API — a permission prompt pops up asking you to approve. It's the "human in the loop" safety valve. The problem: at volume, humans approve almost everything without reading (data last week showed people missed ~1 in 3 dangerous actions this way). Anthropic's bet is that a well-defended agent plus after-the-fact review beats a stream of prompts nobody reads. The catch is that it only works if the underlying defenses (especially against prompt injection) are strong.
What's the community saying?
- "Prompts are theater" vs. "removing the last brake" — supporters agree per-action prompts are useless at scale; critics say defaults matter and beginners will now run an unsupervised agent by accident.
- Prompt-injection is the real question — bcherny claims stacking model training + input probes + layers drives *unseen* injection attacks to ~0; skeptics want the eval details before trusting an unattended agent on the open web.
- Other-model support — Anthropic confirmed you can run its harness against non-Anthropic models via a proxy and won't ban you; this got surprisingly loud approval.
- "Defeating the lethal trifecta" — Thariq joked the post should've been titled this, referencing the dangerous combo of untrusted content + tools + sensitive data.