From 14 August, new Claude Code sessions on Pro, Max, and Team plans will run in auto mode by default. Anyone who has already pinned a specific default keeps it; everyone else gets a one-time prompt at rollout. As of today, classifier overhead is no longer charged on Pro, Max, or Team, which removes the one practical objection teams had to leaving it switched on. For an AU dev team on one of those plans, this is a change worth planning for deliberately rather than discovering when the prompt appears.
What changes on 14 August, and what stays opt-in
Auto mode becomes the default specifically on Pro, Max, and Team. It stays opt-in for now on Enterprise, API, AWS, Google Cloud's Agent Platform, and Microsoft Foundry, though Anthropic has flagged a rollout and un-metering there within a month. Enterprise admins are not locked out in the meantime: managed settings let an admin force auto mode on today, ahead of the broader default change, which is the lever an AU team on Enterprise should actually be evaluating right now rather than waiting for it to arrive automatically.
Mechanically, instead of an interactive approval prompt on every tool call, each action routes through a classifier that blocks irreversible, destructive, or externally-aimed actions. When something is blocked, Claude usually finds a safer path on its own or asks directly. After three consecutive blocks, or twenty within a session, it falls back to manual approval rather than continuing to guess.
The safety data behind the default change
Anthropic backs the change with internal and third-party red-teaming, prompt-injection evaluations, a controlled study with 1,053 paid testers, and production-session analysis. On every measure tested, auto mode matched or beat manual review. The detail that makes the case hardest to argue with: users approved 97% of manual permission prompts under the old default, a rate high enough to suggest reflexive clicking rather than genuine review on most of those approvals.
On productivity, teams and Enterprise adopters using auto mode shipped roughly 25% more pull requests. Early production adopters named in Anthropic's own case studies include Adobe, Nuro, Gusto, and Garner Health, spanning enterprise software, autonomous driving, payroll, and healthcare, a spread that suggests the pattern holds across meaningfully different risk profiles rather than only in low-stakes codebases.
What an AU dev team should actually do before 14 August
Check your plan tier: Pro, Max, and Team get the new default automatically; Enterprise and API stay opt-in until the wider rollout lands.
If you're on Enterprise and want it sooner, an admin can turn it on via managed settings today rather than waiting.
Set a hard-deny list before the switch flips, not after, so the classifier is operating inside guardrails your team actually chose.
Brief your change-management or security sign-off process now if your organisation requires documented approval for a default behaviour change to a dev tool.
That last point matters more for AU businesses than the announcement itself lets on. A default behaviour change to a widely used development tool is exactly the kind of thing a Privacy Act-conscious or APRA-regulated business's change-management process should have a documented position on before it takes effect, not after someone notices the prompts stopped appearing.
Reduces the need for guardrails, doesn't eliminate it
None of this means the classifier removes the need for a hard-deny list at the settings level. It reduces how often a human needs to intervene; it does not make agent execution risk-free, and no AU business should treat auto mode as a substitute for its own settings-level guardrails around recursive deletes, force-pushes to protected branches, or anything touching production credentials. The classifier and the hard-deny list do different jobs, and a team that skips the second because the first sounds sufficient is the team most likely to have a bad week.
The un-metering detail is worth dwelling on too, because it changes the economics of the decision, not just the mechanics. When classifier overhead was billed separately, a team weighing auto mode was implicitly weighing a real cost against a convenience. With that overhead removed on Pro, Max, and Team, the remaining decision is purely about risk tolerance and guardrail readiness, not cost, which is precisely why Anthropic chose to flip the default at the same time it removed the charge.
The Automata AI take
For most of our clients on Pro, Max, or Team plans, this default change is a net positive worth accepting rather than fighting, provided the hard-deny list is set up first. For clients on Enterprise weighing whether to force it on early via managed settings, that is a genuinely useful conversation to have with your security team before 14 August rather than after. A guardrail review and rollout plan for a team typically runs A$1,200 to A$2,500.
Book a brainstorm if you want your team's guardrails set up before auto mode becomes the default on your plan.
