Claude Code Defaults to Auto Mode August 14 — Here Are the 6 Permission Locks to Set First
A default change that silently removes confirmation prompts means every Claude Code user who does nothing wakes up to an agent that can write files, run shell commands, and commit code unsupervised. The 11% classifier miss rate is not theoretical — it translates to roughly 11 uncaught dangerous operations per 100 commands, and the only defense is a deny-rule config that does not depend on human attention.
Anthropic's own data shows 97% of permission prompts get mindlessly approved and Auto mode's classifier blocks 89% of dangerous commands, versus 13.6% for fatigued humans. But an 11% miss rate means roughly one in ten risky operations still slips through. The change takes effect for all Pro, Max, and Team users on August 14.
The practical fix is not reverting to Manual mode, which creates an illusion of safety through prompts nobody reads. A deny-rule configuration that locks environment files, irreversible git operations, global package installs, and CI/CD configs provides a hard backstop that does not fatigue. Allowed operations run automatically; truly dangerous ones still require manual confirmation.
Six specific settings cover the critical surface area: a src/-only write whitelist, .env and credential read/write blocks, git push and destructive reset denials, npx and global install prohibitions, semantic rules in CLAUDE.md, and an audit log to surface what Auto mode actually did.
Anthropic's decision to ship Auto as the default is backed by data showing the old confirmation model was security theater — 97% approval rates mean the prompts trained users to ignore them.
The 6.5x safety improvement claim is real but narrow: it measures classifier-versus-human on a specific test set, not real-world attack surfaces where an adversary crafts prompts to evade the classifier.
An 11% miss rate on dangerous commands is high enough that a deny-rule config is not optional — it is the difference between an agent that occasionally breaks things and one that is contained.
The shift from attention-based security (Manual mode) to configuration-based security (deny rules) mirrors the broader industry move from runtime prompts to policy-as-code in AI agent tooling.
Claude Code's permission model now resembles a firewall: default-allow with explicit deny rules, which puts the burden on the user to know what to block before something goes wrong.