Anthropic makes auto mode the default in Claude Code after humans caught 13.6 percent of dangerous commands

AI coding safety now has an uncomfortable number attached to it. In Anthropic’s own controlled experiment, humans reviewing AI commands caught 13.6 percent of the dangerous ones.

What the experiment found

Anthropic ran the study with 1,053 paid professional testers. Human review, the approve-every-step model that most AI coding tools are built on, caught 13.6 percent of dangerous commands. Auto mode, in which a separate classifier checks each command instead of a person, caught 89 percent.

The decay curve is the most telling part. Human attention dropped with session length: roughly 17 percent of dangerous commands caught early on, falling to about 5 percent after 50 or more prior prompts. The classifier’s catch rate stayed flat regardless of session length.

What changes on August 14

Based on those results, auto mode becomes the default in Claude Code for Pro, Max and Team plans from August 14, 2026. Claude Code no longer pauses at every step. It proceeds unless an action is judged irreversible, destructive, or aimed outside the user’s environment. There are circuit breakers: three blocks in a row, or twenty in a single session, and the tool goes back to asking for approval. Enterprise and API customers stay opt-in for now.

Anthropic’s own caveat is worth quoting in substance: auto mode relies on classification systems and therefore does not eliminate risk, and high-stakes changes to production infrastructure still call for a human.

The uncomfortable reading

The honest interpretation of the data is that clicking approve 200 times a day was never really review. Anthropic’s numbers put a figure on what most developers already suspected about their own behavior: past a certain session length, the approval prompt becomes a reflex, not a checkpoint.

That reframes the safety debate around AI coding tools. The approve-every-step model survives mostly as a comfort ritual, and the measured comparison now favors the machine checking the machine. The unresolved question is what happens when the classifier itself misses, which is why Anthropic keeps humans in the loop for production infrastructure and leaves the most safety-sensitive tiers opt-in.