Auto mode is now the default in Claude Code for Pro, Max, and Team plans

Why it matters

Anthropic is switching auto mode on by default for new Claude Code sessions on several paid plans, a move the company justifies with new evaluations of the feature's safety. In a published conversation, Cat Wu and Thariq Shihipar said Anthropic employees almost universally run Claude Code in auto mode internally, and Wu claimed the main risks, such as prompt injection and data exfiltration, are lower than those of a typical human reviewer. A commissioned test inserted a clearly dangerous command into sessions with paid testers and found that most humans approved it, while auto mode would have blocked the large majority of such actions. Anthropic also cites third-party testing by Trajectory Labs, in which numerous indirect prompt injection attempts against recent Claude models running auto mode all failed. The author, who has publicly predicted a serious security incident for coding agents, welcomes the results but notes gaps: auto mode still would not stop every dangerous action, and attacks like a malicious package posing as a test dependency may evade it entirely. Independent confirmation remains limited.