Claude Code Goes Hands-Free by Default — What You Need to Know

Related articles

• Beware: Claude Code’s Auto Mode Could Silently Override Your PreToolUse Hook ‘Ask’ Guard
• Beware: Your Coding Agent’s “Safe Mode” Can Be Turned Into a Remote Code Execution Engine
• Claude Code v2.1.224: Self-Hosted Runners, Cross-Session Messaging, and Tighter Secret Handling

Starting August 14, 2026, every new Claude Code session on a Pro, Max, or Team plan will open in auto mode by default. That means the agent will stop asking your permission before it runs safe commands, edits files, and makes decisions — it just does them. If you have been using Claude Code for a while, you already know auto mode exists. What changed is the default: you no longer have to opt in.

This is the first time a major AI coding agent has made “hands-free” the default experience for millions of developers. It is worth understanding what it actually means, even if you never change a setting.

What auto mode actually does

Claude Code has three permission modes. Understanding the difference is the whole point.

Normal mode (the current default for existing users)

In normal mode, Claude Code asks your permission before almost every action. It wants to read a file? Prompt. Run a shell command? Prompt. Edit a file? Prompt. The agent does nothing without your explicit OK. It is the safest option and the most interrupt-heavy one.

If you have ever sat through a Claude Code session where the agent asked you to approve 30 sequential tool calls, you know the friction. That is normal mode doing its job.

Auto mode (the new default)

Auto mode keeps the same safety classifier that decides whether an action is safe or risky, but removes the prompt for actions the classifier considers safe. The agent evaluates every tool call, categorizes it as safe or risky, and only asks you about the risky ones. Safe actions — reading files, running tests, editing source code you already gave context about — happen without interruption.

The safety classifier is not a simple allow-list. It uses a trained model that looks at the specific command, the file being touched, and the context of the conversation. Claude Code has shipped multiple fixes to this classifier over the past few months (v2.1.211 fixed a flaw where auto mode overrode hook ask decisions, and v2.1.223 patched a permission bypass), which is part of why Anthropic is now comfortable making it the default.

Auto mode also no longer counts toward your usage limits — the classifier runs on Anthropic’s infrastructure, not your quota. That removes one of the main reasons people avoided it.

YOLO mode (dangerously-skip-permissions)

YOLO mode disables all permission prompts. Everything runs. No classifier, no prompts, no guardrails. It exists for power users who fully trust the agent and their sandbox. It is not becoming the default. Nobody is suggesting you use it.

Who is affected

New sessions, not existing settings

The change only affects new sessions. If you have already set a default mode in your settings (or your organization has managed settings), your choice is preserved. The switch prompt is one-time: when you open your first new session after August 14, Claude Code asks once if you want to accept the new default. Say no and it sticks with your current mode.

Here is the exact behavior:

• You have a user-level default set → your default stays. No change.
• Your org has managed settings → the org default stays. No change.
• You have never changed the default → new sessions open in auto mode.
• You accept the one-time switch prompt → new sessions open in auto mode.

Plans that get auto mode

Auto mode as default applies to:

• Claude Code Pro ($20/month)
• Claude Code Max ($100 or $200/month)
• Claude Code Team (per-seat)

Free tier and Enterprise plans are not affected by this change. Enterprise admins can set their own default mode via managed settings.

How to switch back (or switch early)

If you prefer to stay in normal mode, set it as your default before August 14:

{
  "permissions": {
    "defaultMode": "normal"
  }
}

Put that in ~/.claude/settings.json (user-level) or your organization’s managed settings. Every new session after that will open in normal mode.

If you want to try auto mode before the switch date, set:

{
  "permissions": {
    "defaultMode": "auto"
  }
}

You can also switch modes mid-session by typing /permissions and selecting a different mode. The change takes effect immediately.

For enterprise admins who want to keep normal mode across the entire team, add this to your managed settings:

{
  "permissions": {
    "defaultMode": "normal"
  }
}

Org-managed defaults take precedence over user preferences.

Why Anthropic is doing this now

Three reasons, in order of importance.

1. The classifier is good enough. Auto mode has been available as an opt-in since Week 13 (March 2026). In five months, Anthropic has shipped dozens of fixes and improvements to the classifier — permission bypass patches, hook interaction fixes, safety-filter refinements. The false-negative rate (actions that should have been blocked but were not) has dropped enough that Anthropic is comfortable making it the default. The removal of the Ultraplan preview and the addition of worktree isolation blocking Bash commands and git redirects in the same release (v2.1.224) show that safety hardening shipped alongside the default switch.

2. Developer experience. The single biggest complaint about Claude Code from new users is the permission prompt flood. “I asked it to fix a bug and it asked me to approve 40 things.” Auto mode eliminates that friction for the majority of actions while keeping the safety net for risky ones. For the typical developer who just wants to get work done, auto mode is a better experience.

3. Competitive pressure. Cursor has had its own auto mode (powered by Cursor Router) since July 22. GitHub Copilot has had auto-approve for terminal commands since mid-2025. Making auto mode the default is not just a UX decision — it is a competitive one. Agents that interrupt you less win more daily use.

What to watch out for

Auto mode is better than it was six months ago, but it is not infallible. Two things to keep in mind.

The classifier can be fooled

The “Friendly Fire” exploit, published by the AI Now Institute on July 8, 2026, showed that both Claude Code auto mode and Codex auto-review can be tricked into executing attacker-controlled binaries when reviewing untrusted repositories. The attack uses a compiled binary that looks like a legitimate code-quality tool plus a README reference that triggers execution. The classifier clears it because the binary strings match the source file.

This means auto mode is fine for your own codebase where you control every file. Be more cautious when using it to review untrusted third-party code.

Hooks still matter

Auto mode now correctly respects PreToolUse hook ask decisions (the v2.1.211 fix), but if you do not have hooks configured, you have no safety net beyond the classifier. Consider adding a hook that forces a prompt for unsandboxed Bash commands or file writes outside your project directory. The security checklist article linked above has templates you can copy.

Worktree isolation got tighter

v2.1.224 strengthened worktree isolation: it now blocks Bash commands and git redirects that reach the main checkout, not just file edits. This is a good thing — but if you are used to a session making changes across multiple worktrees, some of those patterns may now be blocked. The agent will surface the block and ask for approval.

What this means for the coding agent industry

Claude Code is not the first agent to support hands-free operation. But it is the first to make it the default for its paid user base. That is a signal.

The trend is toward less interruption

Every major coding agent is moving in the same direction: less asking, more doing. Cursor Router auto mode launched July 22. GitHub Copilot added terminal auto-approve in 2025. OpenHands runs without prompts by design. The question was never whether agents would stop asking permission — it was when they would be good enough.

The security bar just got higher

Making auto mode the default puts enormous pressure on the classifier. Every false negative — a risky action that slipped through — now happens to millions of users by default, not just the opt-in minority. Anthropic will need to ship classifier improvements faster than before, and the security research community will be watching more closely.

Enterprise adoption depends on managed controls

The enterprise story here is controlled autonomy. Admins can set the default mode, restrict which modes are available, and override user preferences. That is the minimum viable governance model for “let an AI agent touch your codebase.” The managed settings story is what makes auto mode enterprise-ready rather than just developer-convenient.

Quick-start: get ready before August 14

1. Check your current mode: Open any Claude Code session and look at the status bar. It shows auto mode on, normal mode, or YOLO mode.
2. Decide: Do you want the new default, or do you want to stay in normal mode?
3. Set your preference: Add the defaultMode setting to ~/.claude/settings.json before August 14 if you want to avoid the switch prompt.
4. If you review untrusted code: Add a PreToolUse hook that forces a prompt for Bash commands or file writes outside your project.
5. Test it: Open a new session, run a few tasks, and see how often the agent interrupts you (or does not). The goal is to find the right balance for your workflow.

Auto mode is not about letting the agent run wild. It is about removing the interruptions that do not add value while keeping the ones that do. August 14 is when Anthropic is betting that most developers are ready for that trade-off.

FAQ

Q1: When does auto mode become the default? Starting August 14, 2026, every new Claude Code session on Pro, Max, or Team plans opens in auto mode by default. Existing sessions and users with custom defaults are not affected.

Q2: Can I stay in normal mode? Yes. Set "defaultMode": "normal" in ~/.claude/settings.json before August 14, or decline the one-time switch prompt when it appears. Enterprise admins can enforce normal mode org-wide via managed settings.

Q3: What are the three permission modes?

• Normal mode: Prompts for almost every action (current default for existing users)
• Auto mode: Prompts only for risky actions; safe actions run automatically (new default)
• YOLO mode (dangerously-skip-permissions): No prompts, no guardrails

Q4: Does auto mode count toward usage limits? No. The safety classifier runs on Anthropic’s infrastructure, not your quota. This was a key reason for making it the default.

Q5: Is auto mode safe for reviewing untrusted code? No. The “Friendly Fire” exploit showed auto mode can be fooled into executing attacker-controlled binaries when reviewing untrusted repositories. Use normal mode or a disposable isolated environment for untrusted code review.

Q6: How do I switch modes mid-session? Type /permissions in any Claude Code session and select a different mode. The change takes effect immediately.