Claude apps will run in auto mode by default and stop asking before each step

What Anthropic announced

Anthropic said on 22 October 2026 that auto mode will become the default for new sessions in most Claude apps on its Pro, Max and Team plans, rolling out starting next week. The change was added as a dated update to its August post on auto mode in Claude Code, and it covers Claude on the web, on the desktop and in the mobile apps.

In practice, Claude will stop asking you to approve each action it takes. Instead, an automated check reviews every action before it runs. Actions judged safe go ahead, and risky ones are blocked while Claude looks for another way to finish the task or asks you directly. You can switch a session back to manual approval at any time.

Enterprise plans are treated differently. Anthropic says Enterprise admins will get an email before auto mode becomes the default for their organisations, and its help centre lists the auto-start setting as off by default on Enterprise. Anthropic has not named the exact day the switch reaches each account.

What auto mode does

Auto mode first shipped in Claude Code, Anthropic's coding agent, where it became the default on Pro, Max and Team plans on 14 August. The idea is simple: rather than showing the user a permission prompt for every tool call, Claude sends each call through a separate classifier model trained to block actions that are irreversible, destructive or aimed outside the user's environment.

Anthropic describes several extra layers. Data exfiltration, such as sending code or secrets to an outside destination, sits in a hard-deny category the classifier is designed never to approve. Content Claude reads from web pages, files and tool outputs is screened by a probe for prompt injection, meaning hidden instructions that try to hijack the agent. The Cowork safety guide adds that Claude always asks before permanently deleting files, in every mode.

If the classifier keeps getting in the way, Claude falls back to asking. In Claude Code that happens after three blocks in a row or twenty in one session. The apps also offer a third mode, Skip all approvals, which removes both the prompts and the safety check; Anthropic advises it only when you fully trust every action, connector, file and app involved.

Which conversations change

Nothing changes for a plain question and answer, because there is no action to approve. The modes matter when Claude acts: editing files, using connectors, filling in web forms, or working through a multi-step task in Cowork, the part of Claude that carries out work rather than only replying.

DataNorth notes that on Pro and Max, Anthropic is gradually merging chat and Cowork into one Claude, so the new default will reach every conversation in which Claude acts. Team organisations still keep chat and Cowork apart, so for them it applies to Cowork tasks. That fits the direction of products like Claude Duet, Anthropic's proactive agent app, which works across other apps on the user's behalf.

The evidence Anthropic is leaning on

Anthropic's case rests on one finding: people stop reading permission prompts. In Claude Code, users approve 97% of them. In a study with 1,053 paid testers, Anthropic swapped one prompt in each session for a clearly dangerous command. Testers caught it 13.6% of the time, or 143 of 1,053, while auto mode blocked 89%, or 937. Human catch rates also fell as sessions got longer, from about 17% early on to about 5% after 50 or more prompts.

The company also re-graded real Claude Code sessions its safety pipeline had flagged between May and June, from accounts that opted in to data use. At production-level severity, 6.3% of manually approved sessions contained a harmful action the user had not explicitly asked for, compared with 2.4% of auto mode sessions. Red-teaming with Apollo Research cut the classifier's miss rate on synthetic attacks from 12% to 7%.

The important caveat is that all of these figures come from Claude Code. Anthropic says it used the findings to strengthen auto mode across its products, but it has published no numbers for the apps, where actions are more likely to be emails, calendar entries, documents and purchases than shell commands. The tests were run by Anthropic or vendors it commissioned, not independently reproduced.

What admins can switch off

Team and Enterprise admins have two switches under Organization settings, then Capabilities, according to Anthropic's help centre. Allow Automatically approve mode is on by default; turning it off removes auto mode from every member's selector. Start new tasks in Automatically approve mode is on by default for Pro, Max and Team and off for Enterprise; turning it off keeps manual approval as the default while still letting members switch.

A third setting, under Organization settings and then Cowork, decides whether members can grant Always allow to connector tools that can change data, such as sending an email or updating a record. It is off by default, so members still approve those tools once per task. Organisations whose AI policy requires a person to approve what an AI tool does before it takes effect will need to change either the setting or the policy before the rollout.

For Claude Code, admins can already pin a default with defaultMode in managed settings or disable auto mode entirely with disableAutoMode, as described in the permission modes documentation.

When to keep manual approval

Anthropic's own guidance is to switch to manual approval when a mistake would be hard to undo, such as sending messages or making purchases, or when a task touches sensitive files or accounts. In the August post it also says auto mode relies on classification and does not eliminate risk, and recommends reviewing Claude's actions yourself for high-stakes changes to production systems.

A practical line for most people: let auto mode handle research, drafting and file work where an error costs a redo, and keep a human click on anything that leaves your control, such as emails, payments, posts and changes to shared records. Giving Claude a dedicated working folder rather than broad file access also limits the damage if something goes wrong.

Credential handling is another layer. Tools such as 1Password's new agent access aim to let agents sign in to services without seeing passwords, which reduces what a misbehaving or hijacked agent could leak even when no one is approving each step.

What is still unclear

Anthropic has not published a block rate, false-positive rate or incident data for auto mode in the consumer and business apps, and it has not said how the classifier handles app-specific actions like sending email through a connector. It has also not given a firm date beyond next week, or said whether the switch reaches all regions at once.

Prompt injection remains the hardest problem. Anthropic's own safety guide warns that if Claude reads malicious content mid-task, it could act on those instructions before the user notices, in auto mode as in Skip all approvals. The classifier lowers that risk; it does not remove it.

Why it matters

This is one of the largest shifts yet in how a mainstream AI assistant handles consent. Until now, the default for consumer agents has been to ask before acting. Anthropic is arguing, with data from coding sessions, that a well-tuned automated check protects people better than prompts they have learned to click through, and it is applying that argument across its paid individual and Team plans at once.

Other companies are building similar gatekeepers. OpenRouter's Armor classifier screens agent tool calls before they run, and OpenAI's Codex has its own Auto-review mode. If auto mode works in the apps as Anthropic says it does in Claude Code, the permission prompt may become the exception rather than the rule for AI agents. If it does not, the first visible failures will show up in inboxes and shared documents, not terminals.