Anthropic's AutoMode Lets AI Approve Actions, Blocking 6.5x More Threats Than Humans

新智元 · wechat · 2026-08-11

Anthropic has introduced AutoMode for Claude Code, shifting the approval of risky actions from human users to an AI classifier. Official tests involving 1,053 users revealed that humans only caught 13.6% of dangerous commands, whereas AutoMode blocked 89%.

Three-Layer Defense System

This mode relies on a layered defense: 1) Base alignment training of the model; 2) An input-side probe to detect malicious prompts in external content; 3) An output-side action classifier (running on Sonnet 4.6) to intercept irreversible or destructive operations. In 720 prompt injection attempts by third-party Trajectory Labs, the system achieved a 0% success rate for attackers.

Limitations and Controversies

Security expert Simon Willison remains cautious, warning about classifier blind spots (e.g., malicious third-party packages) and reiterating concerns about the fragility of coding agents. Furthermore, an independent stress test by HKUST and ETH showed an 81% end-to-end miss rate for specific in-project file modifications. While AutoMode significantly improves efficiency and reduces human "alert fatigue," delegating permissions means users still bear the risk of AI misjudgments.

Related event: Claude Code to Enable Auto Mode by Default Next Week(6 posts)→

Original post →

More from coding & agent

coding & agent channel →