Zero out of 720. That is the prompt injection figure Anthropic is using to defend a default-setting change that will reshape how millions of developers work with its coding agent.
Trajectory Labs, in an independent audit, put Claude Code in Auto Mode through 72 attack scenarios, running each one ten times. Against the company’s current models — Fable 5, Opus 5 and Sonnet 5 — not one of the 720 attempts landed. The same battery aimed at OpenAI’s GPT-5.6 Sol in Codex Auto-Review mode succeeded 5.83 percent of the time.
From August 14, Auto Mode arrives switched on by default for Claude Code users on Pro, Max and Team plans, according to an Anthropic blog post. Enterprise customers are the exception and must opt in themselves.
What the classifier handles on your behalf
With Auto Mode, the tool no longer halts for manual sign-off at every step. Instead, a classifier judges whether a given action is dangerous or irreversible, and the agent pauses to ask only in those cases.
The approval prompt, in other words, hasn’t gone anywhere. It simply stops appearing for routine work — precisely the category developers were waving through without much thought.
A bigger pile of pull requests is not a better one
The company put Auto Mode in front of 1,053 paid testers and paired that with internal red-teaming, concluding it was at least as safe as manual approvals and frequently safer. Teams running it also produced roughly 25 percent more pull requests.
That second figure deserves a second look. It captures throughput rather than correctness. A quarter more PRs means a quarter more code awaiting review — and review is exactly the burden Auto Mode hands to you.
Two internal near-misses
According to Anthropic, Auto Mode blocked Claude from posting confidential data to a public page inside the company. In another instance, during a lengthy session, it terminated somewhere around 2,000 processes that would otherwise have interfered with GPU training jobs already underway.
Details like those land harder than any safety score, because they let you visualise the incident that never occurred.
Who foots the bill for the safety layer
The tokens burned by the classifier itself are free, which reads as generous right up until you work through the remaining arithmetic. Longer Claude sessions that complete more work mean higher overall token consumption, and higher revenue with it. Anthropic maintains that this wasn’t the driving motivation — the incentive nonetheless leans the same way.
Guidance that sits awkwardly beside the default
Claude Code leads the AI coding tool market by a considerable distance, and throwing this switch nudges the developer’s role even further from writing code toward vetting what the model produced. Anthropic itself counsels restraint here.
Risk is reduced by the classifier, not removed. “For high-stakes changes to production infrastructure, we still recommend reviewing Claude’s actions yourself,” the company writes.
That creates a genuine bind. Intervene less often and every intervention carries more weight, while building real fluency with a codebase Auto Mode largely authored becomes steadily harder. Cybersecurity keeps getting faster and more complicated than any person can track.
Pro, Max and Team subscribers get this on August 14, requested or not. Set aside an afternoon beforehand to map where the classifier draws its boundaries on your own infrastructure — a production deploy is the wrong moment to learn that for the first time.