Anthropic Makes Claude Code Auto Mode Default, Claims Prompt Injection Solved

Simon Willison · rss · 2026-08-09

Anthropic is setting auto mode as the default for Claude Code across most paid plans starting August 14, demonstrating strong confidence in its safety mechanisms.

Confirmation Fatigue vs. Auto Mode

Broadly within Anthropic, almost everyone uses auto mode. An experiment with 1,053 paid testers showed that only 13.6% of humans refused a clearly dangerous command swapped in mid-session, whereas auto mode would have blocked 89% of them. Constant human approval causes "confirmation fatigue," making auto mode a safer alternative.

Prompt Injection Mitigation

Third-party evaluator Trajectory Labs tested 72 indirect prompt injection scenarios across 720 attack attempts. Claude Fable 5, Opus 5, and Sonnet 5 running in auto mode successfully blocked all attacks. Anthropic claims they have largely mitigated major risks like data exfiltration.

Remaining Concerns

Despite the astonishing results, Simon Willison remains cautious. He highlights a potential bypass scenario where a malicious third-party package disguises data exfiltration commands as regular test suite instructions. He emphasizes that limiting agent access to unnecessary sensitive data and tools remains a critical defense.

Original post →

More from coding & agent

coding & agent channel →