Claude Code Auto Mode Blocks 89% of Dangerous Commands and Prompt Injection Attacks

Anthropic will make Auto Mode the default setting in Claude Code for Pro, Max, and Team subscribers starting August 14, 2026. This change introduces an automated classifier to replace repetitive manual permission approvals during long-running development tasks.

The goal is to reduce “permission fatigue,” a condition where developers approve prompts without thoroughly examining the associated risks.

Anthropic reports that users approve 97% of Claude Code permission prompts and reject only 3%. In contrast, users reject 39% of proposed plans, suggesting that individual command prompts receive less scrutiny than broader workflow decisions.

Claude Code Auto Mode Blocks Attacks

Auto Mode routes every tool call through a classifier designed to identify irreversible, destructive, or externally targeted actions.

When a command is blocked, Claude Code can either attempt a safer alternative or ask the user for direct approval. If the system encounters three consecutive blocks, or 20 blocks in a session, it reverts to manual approvals.

In a controlled study involving 1,053 paid professional testers, manual reviewers blocked only 13.6% of deliberately inserted dangerous commands.

In comparison, Auto Mode blocked 89% of commands, successfully stopping 937 of 1,053. The study simulated coding sessions in a test environment.

It replaced one standard permission request with a clearly harmful command, but no dangerous actions were executed. According to Anthropic, Auto Mode blocked 800 commands that human participants approved. In comparison, human reviewers blocked only 6 commands that the classifier had allowed.

Manual performance also declined as sessions became longer. Testers blocked about 17% of dangerous commands early in a session.

However, that figure dropped to approximately 5% after encountering 50 or more earlier prompts. Auto Mode’s detection rate remained consistent, regardless of prompt volume.

Anthropic reported that Auto Mode successfully prevented all attacks during an independent prompt-injection assessment conducted by Trajectory Labs.

The test covered 72 indirect prompt-injection scenarios, each executed 10 times, for a total of 720 attempts per evaluated model.

Claude Fable 5, Claude Opus 5, and Claude Sonnet 5, running in Auto Mode, recorded zero successful prompt-injection attacks during the evaluation.

The tested attacks simulated malicious attempts to trigger irreversible actions, including data exfiltration, credential phishing, and financial fraud.

Auto Mode includes several security controls aimed at limiting agent misuse:

• Hard-deny rules for external data exfiltration.
• Git destination checks to distinguish between public, private, and trusted repositories.
• Git status awareness before executing destructive actions, such as ‘git reset –hard.’
• Screening of web content, files, and tool output for embedded prompt injection attempts.
• Context-aware checks to assess whether an action aligns with the user’s stated intent.

Anthropic indicated that its classifier evaluates repository visibility, Git state, data-sharing rules, and the sensitivity of information involved in an action.

The company disclosed three internal incidents in which Auto Mode reportedly prevented potentially damaging operations: an attempted public upload following an internal drive failure, a mass process termination targeting about 2,000 pods and hundreds of GPU training jobs, and an overprivileged cloud billing role assignment that would have granted root-level administrative access.

Auto Mode remains optional for Claude Enterprise, API users, and cloud-platform deployments, including AWS, Amazon Bedrock, Google Cloud’s Agent Platform, and Microsoft Foundry.

Anthropic plans to extend the default setting to these environments in the coming month while allowing enterprise administrators to enable it through managed settings.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world