Anthropic Adds Auto Mode to Claude Code to Reduce Permission Prompts

Anthropic announced a new auto mode for Claude Code that allows the coding assistant to make some permission decisions on behalf of users while applying additional safeguards before tool calls.

A response to permission fatigue

In its Claude Code auto mode announcement, Anthropic describes the feature as a research preview designed to reduce routine approval prompts. Claude Code, the company’s terminal-based coding assistant, often asks users to approve actions before it runs commands, edits files, or uses other tools. Anthropic says those prompts are important for safety, but can become repetitive during normal development work.

Anthropic’s engineering post says Claude Code users approve 93% of permission prompts. The company argues that this pattern can lead to “approval fatigue,” where users may grant permissions quickly without carefully evaluating each request. Auto mode is intended to reduce that burden by allowing low-risk actions to proceed automatically, while still blocking or escalating actions judged to be risky.

How auto mode works

According to Anthropic’s engineering write-up, auto mode routes Claude Code tool calls through safety classifiers before the action is taken. Those classifiers evaluate whether a proposed action appears safe enough to approve automatically, should be denied, or should still require explicit user approval.

Anthropic says the system is designed to preserve friction for actions that could cause harm, including dangerous shell commands, attempts to exfiltrate data, and other high-risk agent behavior. The company’s Claude Code documentation also says managed settings can enforce non-overridable deny rules before classifier review, giving organizations a way to block certain actions outright.

The Claude Code docs state that organizations can configure trusted infrastructure at the organization level. This is meant to help the system distinguish between expected development resources and unknown or potentially risky destinations. Anthropic says auto mode is not a blanket permission grant; it is a policy and classifier-driven system that decides whether each action should proceed.

Enterprise controls remain central

The feature arrives amid broader scrutiny of AI coding tools that can read files, run commands, modify repositories, and interact with developer environments. Anthropic’s materials emphasize that auto mode is meant to reduce unnecessary prompts without removing safety boundaries.

For enterprise administrators, the documentation highlights managed settings and deny rules as important controls. These settings can prevent specific categories of activity regardless of what the classifier would otherwise decide. That matters because coding assistants can operate in sensitive environments containing source code, credentials, build systems, and internal data.

TechRadar, in its coverage of the release, similarly reported that Claude Code auto mode can approve actions assessed as safe while blocking or prompting for riskier operations, including deletion-related actions. That third-party report aligns with Anthropic’s own description of a feature that is meant to automate routine approvals while keeping additional review for higher-risk behavior.

Still a research preview

Anthropic labels auto mode as a research preview, which signals that the company is still evaluating the approach. The company’s public posts do not present the system as eliminating risk. Instead, they frame it as an attempt to make permission prompts more useful by reserving them for decisions that matter most.

The central trade-off is familiar in security design: too many prompts can train users to click through, while too few prompts can give software too much freedom. Anthropic’s answer is to add an automated decision layer backed by classifiers, organization settings, and hard deny rules.

For developers, auto mode may make Claude Code feel less interruptive during everyday work. For security teams, the important question will be how well the classifiers identify risky actions in real-world environments, and how carefully organizations configure the controls Anthropic provides.