The safety model for AI coding agents has, until now, rested on a simple idea: before the agent does anything consequential — delete a file, run a shell command, reach into an external system — it stops and asks a human to approve. The human is the backstop. On 14 August, Anthropic is retiring that backstop as the default in Claude Code, and the reason it gives is the most revealing part of the announcement.

According to the company, developers approved 97% of the permission prompts the tool put in front of them. A safeguard that is waved through ninety-seven times out of a hundred is not being read; it is being clicked. Anthropic's own framing is candid about this — the prompts had become a source of fatigue rather than a moment of review. So from 14 August, "auto mode", in which Claude Code works without stopping for per-action approval, becomes the default for Pro, Max and Team subscribers. A keyboard shortcut still switches it off; the human gate does not vanish, it stops being the thing that happens by default.

What replaces the prompt is a classifier. Rather than asking the user, auto mode routes each tool call through a model trained to catch actions that are irreversible, destructive, or that reach inappropriately into outside systems; when it flags something, Claude is meant to find a safer route or ask for explicit confirmation. The loop, in other words, is still there. It has simply moved from the human to another model. Safety-by-human-in-the-loop is becoming safety-by-model-in-the-loop.

Anthropic brought numbers. In a study it says involved 1,053 paid testers, auto mode blocked 89% of dangerous commands, against 13.6% caught by human review; in production, it says the mode prevented harmful unintended actions roughly twice as often as manual approval; and against prompt-injection attacks — the standing nightmare of autonomous agents — it reports a 0% success rate across 720 attempts. Taken at face value, the classifier does not merely match the fatigued human, it comfortably beats them.

Face value is where the caution belongs. Every one of those figures is the vendor's own, measured on the vendor's own evaluations, and none has yet been reproduced by an outside party — the same caveat this desk applies to any lab grading its own homework. The zero-across-720 result in particular is a bounded red-team exercise, not a proof of invulnerability: 720 attempts is a test, and the attacks that matter are usually the ones nobody has written yet. There is also a structural point the headline glides over. A human approver and a classifier fail in different shapes. A tired human rubber-stamps, but does it inconsistently; a classifier that is blind to a class of dangerous action is blind to it every time, for everyone, until it is retrained. Moving the gate from many unreliable humans to one reliable model concentrates the trust — and with it, the blast radius of a miss.

It is worth being precise about what has actually improved. Anthropic is dropping the classifier's token cost for Pro, Max and Team users, so the safety layer is not something you pay per call to keep switched on; enterprise customers keep manual approval as their default for now, with auto mode available opt-in, and the company says it plans to make it the default there too within the coming month; and switching auto mode off is a keyboard shortcut away. This is not autonomy imposed so much as autonomy made the path of least resistance — which, given that 97% figure, is arguably an honest description of what was already happening.

That honesty is the thread worth holding. On Saturday this desk argued that 2026's real question about AI-written code is not whether a model can produce it but where anyone will accept it. Anthropic has now answered a version of that question for its own tool: accept it by default, and let a classifier — rather than a click-fatigued developer — be the thing that says no. Whether the rest of the field follows the default-to-autonomous move, and whether that 89% survives contact with a tester who does not work for the vendor, is the story to watch. The permission prompt is not being retired because it was working. It is being retired because it wasn't.