Anthropic Makes Claude Code Auto Mode Default, Claims Prompt Injection Solved
Simon Willison · rss · 2026-08-09
Anthropic is setting auto mode as the default for Claude Code across most paid plans starting August 14, demonstrating strong confidence in its safety mechanisms.
Confirmation Fatigue vs. Auto Mode
Broadly within Anthropic, almost everyone uses auto mode. An experiment with 1,053 paid testers showed that only 13.6% of humans refused a clearly dangerous command swapped in mid-session, whereas auto mode would have blocked 89% of them. Constant human approval causes "confirmation fatigue," making auto mode a safer alternative.
Prompt Injection Mitigation
Third-party evaluator Trajectory Labs tested 72 indirect prompt injection scenarios across 720 attack attempts. Claude Fable 5, Opus 5, and Sonnet 5 running in auto mode successfully blocked all attacks. Anthropic claims they have largely mitigated major risks like data exfiltration.
Remaining Concerns
Despite the astonishing results, Simon Willison remains cautious. He highlights a potential bypass scenario where a malicious third-party package disguises data exfiltration commands as regular test suite instructions. He emphasizes that limiting agent access to unnecessary sensitive data and tools remains a critical defense.
More from coding & agent
- DIRECT: retrieval-based next-question suggestions for conversational agents — burkov · 2026-10-16
- Claude Code and Codex now autocomplete the user's next action — tokenbender · 2026-10-16
- Hermes Agent ships official Reverse Engineer Anything plugin with one-command setup — Teknium · 2026-10-16
- MLExpert: 35B MoE Agent Trained to Autonomously Handle Machine Learning Engineering — Shangheng Du · 2026-10-16
- Cowork-Gym: Alibaba Synthesizes 64.9K Agent Work Environments, Boosting Qwen by 8.7 Points — Anni Zou · 2026-10-16
- MMSearch-OPD: Joint RL and On-Policy Distillation for Long-Horizon Multimodal Search Agents — PekingUniversity · 2026-10-16