Auto Mode Default in Claude Code: Stay in Control

Will Claude rewrite half your repo while you refill coffee now that auto mode is the default in Claude Code?

That question hit my timeline the same week Anthropic flipped the switch. As of August 14, 2026, new sessions on Pro, Max, and Team start in auto unless you already pinned another mode. Enterprise and API paths stay opt-in for now (official announcement). This piece is not a news rehash – it’s the config I actually changed after the one-time prompt, plus the gates that stop a silent push.

Gotchas the announcement glosses over

Three traps burned real time for me. Fix these before you trust a long unattended run.

• Project-level defaultMode: "auto" is ignored. Paste it into .claude/settings.json or settings.local.json, restart, and the session still opens manual – with no error. Per the permission modes docs, auto must live in ~/.claude/settings.json so a repo cannot grant itself auto. Same trap: VS Code’s claudeCode.initialPermissionMode does not accept auto.
• Broad Bash wildcards go quiet in auto. Rules like Bash(*), Bash(python:*), or blanket package-manager allows get suspended while auto is on so the classifier can see those commands. Your settings file is not rewritten; the rules return when you leave auto. Narrow allows (one specific formatter) still carry over unless autoMode.classifyAllShell is true.
• Remotes added mid-session are untrusted. Only remotes present at session start count. git remote add / set-url during the run looks external until you restart or re-teach trust. Separately: “cannot determine the safety of an action” means the classifier request failed (often transient, fail-closed) – not “auto is gone forever.” True unavailability is plan, model, or org requirements (supported models differ by provider; older Haiku/3.x lines are out).

After three classifier blocks in a row – or twenty in one session – Claude Code falls back to manual approvals so you are not stuck in a silent deny loop.

Pin the default where it actually sticks

Never set a default? New Pro/Max/Team sessions just land in auto after rollout. Already pinned something else? You may get a one-time “switch to auto?” prompt – ignore it and nothing changes. Org-managed defaults stay put.

{
 "permissions": {
 "defaultMode": "auto"
 }
}

User file only: ~/.claude/settings.json. One-shot still works: claude --permission-mode auto. Toggle live with Shift+Tab in the CLI (status reads like auto mode on) or the desktop mode dropdown.

Classifier overhead is a small extra token cost per tool call. As of the August 7, 2026 announcement day, Pro, Max, and Team are not charged that overhead against usage limits.

Human checkpoints that survive auto

Default auto can still push the current repo (including the default branch) and open PRs, with content checks for secrets and force-push-style damage. I do not want a silent push while I am in another tab.

permissions.ask runs before the classifier and always prompts:

{
 "permissions": {
 "ask": [
 "Bash(git push *)",
 "Bash(gh pr create *)"
 ],
 "defaultMode": "auto"
 }
}

Chat lines like “don’t push until I review” die when context compacts. Ask/deny rules do not. Hard stops belong in permissions.deny – blocked before the classifier entirely.

Company GitHub orgs and internal buckets: teach the boundary with autoMode.environment in user or managed settings (prose strings; keep "$defaults" so built-ins survive). autoMode blocks are not read from project .claude/settings.json.

claude auto-mode defaults
claude auto-mode config

Full knobs: auto mode config docs.

Plan, then auto, then gate the ship

Last week: rename a domain type across a small TypeScript service, fix imports, update tests. Loop that felt calm:

1. Start in plan (claude --permission-mode plan or Shift+Tab). Let it map files and propose. Anthropic’s data puts plan rejection around 39% – that review is the high-value minute.
2. Approve with the continue-in-auto option when offered.
3. Walk away for mechanical edits and tests. In-repo writes skip the classifier for speed (git still sees them). Shell, network, and outside-repo actions still go through it – details in Anthropic’s engineering write-up on auto mode.
4. At git push / gh pr create, ask rules force a prompt. Skim diff, then allow.

Think of the classifier as a tired senior who only wakes up for blast-radius moments – not every semicolon.

Why pure click-through and pure bypass both fail

Manual feels safe until you live there. People approve roughly 97% of permission prompts – so the ritual stops being a review. A controlled Anthropic study (1,053 paid testers) had humans catch 13.6% of planted dangerous commands; the auto classifier hit 89% on the same set. Long sessions make humans worse, not better.

So teams slide into bypassPermissions or giant Bash allows. Zero friction, zero second opinion. Auto lands between them: tool calls still run, but irreversible, destructive, or out-of-environment moves get blocked first.

Teams and Enterprise adopters Anthropic cites ship about 25% more PRs on auto. Not better code by itself – fewer interruptions on work you already trust directionally. HN mood is mixed: some people have run auto for months on careful sysadmin work; others still want plan as the default and worry about wide filesystem reads.

Pro tip: Auto for the long middle. Plan when blast radius is unclear. Ask rules on push/PR. Autonomous editing without autonomous shipping.

How much autonomy do you actually want on a Tuesday afternoon with production credentials in the environment? That is the only real setting – and no default answers it for you.

FAQ

Can I keep manual mode as my default after August 14?

Yes. Refuse the one-time switch prompt, or set "defaultMode": "default" or "plan" in ~/.claude/settings.json. Org-managed settings win on Team/Enterprise.

Does auto mode mean Claude never asks me anything?

No. Add permissions.ask for Bash(git push *) and you still get a hard stop before a remote update – even mid-auto refactor. Deny rules and out-of-trust actions still block. Repeated classifier blocks flip you back to manual prompts. Auto cuts routine “allow this write?” noise; it does not delete the permission system.

I’m on Enterprise / Bedrock / API – am I forced in?

Not at the August 2026 Pro/Max/Team rollout. Those surfaces stay opt-in for now, with a default planned in the following month per Anthropic. If auto never shows up in Shift+Tab, check plan eligibility and model support for your provider before blaming the UI – cloud model minimums differ from the Anthropic API list (Opus 4.6+/Sonnet 4.6+/Fable 5 on API; providers document their own floors).

Open ~/.claude/settings.json now, set the defaultMode you actually want, add ask rules for git push and gh pr create, then run claude auto-mode config once so you see what the classifier believes about your machine before the next long task.