Claude Code Makes Auto Mode Its Default Starting Permission Mode on Every Plan and Provider

Overview

Anthropic has widened the set of Claude Code users whose sessions begin without per-action permission prompts. According to the Claude Code changelog, version 2.1.284, dated September 28, 2026, “Changed interactive terminal and VS Code sessions to start in auto mode when no permission mode is configured, on every plan and provider; permissions.defaultMode still overrides it.”

The change extends a default that, per the Claude Code permission-modes documentation, applied on earlier versions “only on Pro, Max, and Team plans.”

What Changed

• Version 2.1.283 (September 25, 2026): the changelog lists a change for interactive sessions on third-party providers or with telemetry off, which now start in auto mode when no permission mode is configured.
• Version 2.1.284 (September 28, 2026): the default applies to interactive terminal and VS Code sessions on every plan and provider, per the same changelog.
• Version 2.1.285 (September 29, 2026): the changelog extends the same default to claude -p and Python Agent SDK sessions on third-party providers or with telemetry off, where --permission-mode still overrides it.

The earlier Pro, Max and Team default began on August 14, according to Simon Willison, who wrote that Anthropic was making it “the default setting for new sessions in most Claude Code plans starting on August 14th.”

How Auto Mode Works

The documentation describes auto mode as a setup in which “a second model, the classifier, reviews actions instead of you.” It says the classifier reviews actions before they run, “blocking anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read.”

Several limits apply, according to the same documentation:

• If the classifier blocks an action 3 times in a row or 20 times total, auto mode pauses and Claude Code resumes prompting.
• By default the classifier does not review rm and rmdir removals targeting a critical path.
• Where auto mode is unavailable to a session, for example because of an unsupported model or a setting that turns it off, Claude Code starts the session in Manual mode instead.
• On Team and Enterprise plans, administrators can turn auto mode off for the organization by setting permissions.disableAutoMode to "disable" in managed settings.

The documentation also carries an explicit caution: “Auto mode reduces permission prompts but does not guarantee safety.”

Opting Out

Per the documentation, setting permissions.defaultMode to "default" in ~/.claude/settings.json makes every terminal session on a machine start in Manual mode. The documentation adds that a value of "auto" in a project’s .claude/settings.json or .claude/settings.local.json does not take effect. It also says Claude Code shows a notice the first time the built-in default starts one of a user’s sessions in auto mode.

The Safety Evidence Behind the Default

When the Pro, Max and Team default was announced, Simon Willison summarized Anthropic’s published evaluations. In a test across 1,053 paid testers, in which a single permission prompt was swapped for a clearly dangerous command, “Only 13.6% of the humans refused that harmful action. Auto mode would have blocked 89% of those actions.”

He also quoted Anthropic’s account of a third-party evaluation by Trajectory Labs covering 72 indirect prompt injection scenarios: “In this evaluation, none of the 720 attack attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode.”

Willison wrote that “Confirmation fatigue is real,” but also noted that “that still leaves 11% of cases where auto mode would not have prevented the action,” and that he would like “to see more independent confirmation of this” regarding the prompt injection results.

What We Don’t Know

• The cited evaluations were published for the earlier Pro, Max and Team rollout and name specific models. None of the three sources reviewed here reports separate results for the newly covered plans or for third-party providers.
• The changelog entries do not say how many users or sessions are affected by the broader default.
• Whether independent researchers will reproduce the reported prompt injection results has not been reported in the sources reviewed.