The approval screen has moved. Starting August fourteenth, twenty twenty-six, new Claude Code sessions for Pro, Max, and Team plan users open in auto mode by default [2]. Auto mode does not remove approval from the workflow. It moves approval from a person clicking a button to software that decides whether an action should proceed. The reviewer changed; the review did not disappear.
What the Classifier Actually Does
A classifier is software that evaluates an action—read this file, run this command, write to this directory—and returns a verdict without human input. Anthropic's auto mode uses a two-stage transcript classifier. It checks the user's instructions and the agent's proposed tool calls against fixed decision criteria before an action executes [1]. When the classifier approves, the agent proceeds. When it denies, the agent is told to find a safer path.
The system has a human escalation floor. The classifier escalates after three consecutive denials or twenty total denials [1]. That floor matters, but it only activates when the classifier is already saying no. The dangerous case is when it says yes incorrectly.
One data point explains why Anthropic built this system. In the company's engineering data, users approved ninety-three percent of permission prompts [1]. The practical promise of auto mode is reducing that habitual clicking. The practical cost is that a human no longer sees most of those prompts at all.
The Vendor's Own Miss Rate
Anthropic published the classifier's error rates. On fifty-two real cases where the agent was taking an overeager action, the classifier failed to catch seventeen percent of them [1]. Anthropic called this figure “the honest number.” On one thousand synthetic attempts to extract sensitive data from the system, the miss rate was five-point-seven percent . On ten thousand real internal tool calls, the false-positive rate—safe actions incorrectly blocked—was zero-point-four percent [1].
A false negative is a dangerous action the classifier allows. These are vendor-reported numbers, not independently verified. The vendor chose to publish them. Anthropic also states directly that auto mode is not a drop-in replacement for careful human review on high-stakes infrastructure [1]. That warning comes from the engineering team that built the classifier.
Who Is on Default
New Pro, Max, and Team sessions run in auto mode already. Enterprise customers, API users, and users on listed cloud platforms remain on opt-in for now. Anthropic announced a plan to make auto mode the default for them “in the coming month” [2]. Teams using those plans have time to write a policy before the default changes. The announcement also recommends that people still review high-stakes changes to production infrastructure themselves.
The Hidden Instruction Problem
Auto mode adds a second protection layer alongside the classifier: a server-side probe that scans tool outputs before the agent reads them. This is meant to catch prompt injection, which means hostile instructions hidden inside a document, webpage, or tool response the agent reads during normal work [1]. Imagine the agent is asked to summarize a vendor's documentation, and that documentation contains an instruction telling it to copy credentials to an external destination. The probe is designed to flag that instruction before the agent acts on it.
Why is another control still necessary? Because Anthropic's product announcement says classification does not eliminate risk [2]. The probe can screen what the agent reads, and the classifier can judge what the agent tries to do. Neither claim means every dangerous action will be stopped. The published miss rates make that limit concrete.
What Sandboxing Requires
A sandbox is an isolated workspace with restricted file and network access. The word gets used loosely, so the definition matters. Anthropic's engineering guidance says effective sandboxing requires both filesystem isolation and network isolation [3]. Without network isolation, a compromised agent can send sensitive files out. Without filesystem isolation, it can reach beyond the intended workspace and gain network access.
This is vendor guidance, not independent proof that a particular setup is secure. But the two-part test—does this environment restrict both file access and network access?—gives a manager something concrete to require before an agent touches real work. Your technical team can choose the implementation. Your policy should define the boundary it must enforce.
The Rule
A NIST analysis of government and industry input on AI agent security found broad agreement that agents introduce novel security threats, those concerns impede adoption, and established cybersecurity practices require adaptation for this context [4]. NIST was synthesizing responses, not evaluating Claude Code. The relevant point is narrower: a new way of granting software authority requires an explicit control around that authority.
Here is the rule your team needs now, written plainly enough to put in a shared document today: any AI coding agent running unattended on real work must run in a sandboxed workspace with both file and network access restricted. Anything that touches production systems, stored credentials, or shared data requires a human reviewer to confirm completion before it counts as done.
That rule draws a clear line between work the classifier can approve and work that still belongs to a person. Auto mode can reduce habitual clicking and catch dangerous actions. It cannot make the final risk decision for your team.