Claude's apps go auto mode by default next week, and a classifier replaces your approve button
Anthropic said on X late on October 22 that starting next week, sessions in the Claude web, desktop and mobile apps will run in auto mode by default on Pro, Max and Team plans. Instead of asking you to approve each step, an automated check blocks risky actions, and you can switch back to manual any time. The post passed 2.2 million views within a day. Announcement: https://x.com/claudeai/status/2113360845409583307
This is the biggest consumer agent surface moving its default from human in the loop to classifier in the loop, and the reasoning is in Anthropic's own engineering post from when auto mode arrived in Claude Code. Users accept 93 percent of manual permission prompts anyway, which is approval fatigue in one number. The classifier sees only user messages and the agent's tool calls, with the agent's own text stripped out so it can't argue its way past the check. The honest number Anthropic printed: a 17 percent false-negative rate on real overeager actions, at 0.4 percent false positives end to end. Anthropic's own framing is that this beats skipping permissions entirely and is arguably a regression for someone who reviews every action carefully. Post: https://www.anthropic.com/engineering/claude-code-auto-mode
The same day, Anthropic published the safety write-up it had promised for Claude Duet, and it shows what the default looks like when real money and accounts are involved. The approval card and a separate check built on the auto mode classifier sit outside the model, "so nothing the agent reads can answer the card." Trading securities, moving money between accounts and accessing someone else's account stay off-limits even with your approval. Paying, deleting an order and creating an account can never be covered by "don't ask me again." Passwords go into an in-app form encrypted with a single-use key, so the model never sees them, and connector tokens never enter the agent's machine: a placeholder sits there and a proxy outside swaps in the real value. https://claude.com/resources/articles/claude-duet-safety-privacy-and-security
The interesting tension is in the numbers. A one-in-six miss rate on overeager actions is fine for a coding session on a laptop. For an assistant connected to your email and calendar, it only works because the dangerous verbs are hard-coded out of the classifier's hands. That is the real design pattern here: a small list of actions no model gets to approve, a classifier for the long middle, and humans only at the edges.
← Back to all articles
This is the biggest consumer agent surface moving its default from human in the loop to classifier in the loop, and the reasoning is in Anthropic's own engineering post from when auto mode arrived in Claude Code. Users accept 93 percent of manual permission prompts anyway, which is approval fatigue in one number. The classifier sees only user messages and the agent's tool calls, with the agent's own text stripped out so it can't argue its way past the check. The honest number Anthropic printed: a 17 percent false-negative rate on real overeager actions, at 0.4 percent false positives end to end. Anthropic's own framing is that this beats skipping permissions entirely and is arguably a regression for someone who reviews every action carefully. Post: https://www.anthropic.com/engineering/claude-code-auto-mode
The same day, Anthropic published the safety write-up it had promised for Claude Duet, and it shows what the default looks like when real money and accounts are involved. The approval card and a separate check built on the auto mode classifier sit outside the model, "so nothing the agent reads can answer the card." Trading securities, moving money between accounts and accessing someone else's account stay off-limits even with your approval. Paying, deleting an order and creating an account can never be covered by "don't ask me again." Passwords go into an in-app form encrypted with a single-use key, so the model never sees them, and connector tokens never enter the agent's machine: a placeholder sits there and a proxy outside swaps in the real value. https://claude.com/resources/articles/claude-duet-safety-privacy-and-security
The interesting tension is in the numbers. A one-in-six miss rate on overeager actions is fine for a coding session on a laptop. For an assistant connected to your email and calendar, it only works because the dangerous verbs are hard-coded out of the classifier's hands. That is the real design pattern here: a small list of actions no model gets to approve, a classifier for the long middle, and humans only at the edges.
Comments