Auto mode is now the default in Claude Code: a classifier evaluates each agent action and blocks the potentially harmful ones instead of asking a developer to approve every command by hand. Anthropic's own internal evals found the classifier caught more dangerous actions than developers did clicking through prompts manually, and it held up under third-party red-teaming. The practical effect is that sessions pause far less often. Across all Claude Code usage, developers now work roughly nine times longer between interruptions than under the previous default.
What Nuro actually built before Anthropic shipped it
The most interesting detail in Anthropic's production case study is not the feature itself, it is that one of the companies using it had already half-built it themselves. Staff engineer Kai Zhou at Nuro, the Level 4 autonomous driving company, had prototyped an internal auto-approval hook before auto mode shipped: auto-approve routine actions, route sensitive ones to Slack for a human to review. He shelved his own version once the real feature launched.
Nuro now runs auto mode for 100% of its coding work, often three to four parallel sessions at once, switching back to interactive mode only for pull-request review work that touches other teams' code. Crucially, Nuro still hard-denies the most dangerous commands, recursive deletes among them, at the settings level. The classifier operates inside those guardrails, not instead of them. The biggest unlock for the team has been long-running overnight research agents that hill-climb autonomous-driving evaluation metrics unattended, work that simply was not practical when every risky-looking action needed a human to click approve.
Nuro was one of several production case studies in Anthropic's same-day roundup, alongside payroll and HR platform Gusto and healthcare-navigation company Garner Health, each running Claude Code auto mode across meaningfully different risk profiles, from safety-critical driving software to systems handling sensitive payroll and health data.
The pattern AU engineering teams should actually copy
The takeaway for an Australian engineering team evaluating Claude Code is not "turn on auto mode and stop reviewing." It is Nuro's specific combination: hard-denied commands as a settings-level floor, a classifier handling the judgment calls in between, and interactive mode kept for the work that genuinely benefits from a human in the loop, like cross-team PR review. Guardrails plus a classifier, not guardrails instead of judgement.
Set a hard-deny list first: recursive deletes, force-pushes to protected branches, and any command that touches production credentials, before enabling auto mode at all.
Keep interactive mode for cross-team or customer-facing changes where a second set of eyes catches context the classifier cannot see.
Watch the interruption-rate metric over the first fortnight, a team that still gets asked for approval constantly likely has an overly conservative hard-deny list worth revisiting.
Treat long-running unattended sessions, like Nuro's overnight research agents, as the actual payoff, not the headline feature.
Where this fits an AU compliance posture
For a Sydney or Melbourne engineering team operating under APRA CPS 230 or general Privacy Act obligations, the settings-level hard-deny list is also the artefact worth keeping for an audit trail. It answers the obvious question a security review will ask: what, specifically, is the AI agent structurally unable to do, regardless of what the classifier decides in the moment.
What the numbers actually tell you
A nine-times reduction in interruptions sounds like a headline metric a vendor would round up, but it matches what the underlying mechanism predicts. Under the old default, a session paused for anything the system judged remotely risky, which in practice meant most non-trivial actions. A classifier that is actually calibrated to distinguish routine work from genuinely dangerous work removes the vast majority of those pauses without removing the safety check itself, it just moves the check from every action to the actions that matter.
That distinction is the whole argument for auto mode over either extreme. Full manual approval on every action does not scale past a handful of parallel sessions, a developer simply cannot review that volume of prompts carefully, which means approval becomes reflexive clicking rather than real review. Fully unsupervised execution, on the other hand, is not something any serious engineering team should accept without a hard-deny floor underneath it, regardless of how good the classifier's internal eval scores look.
The Automata AI take
Most of the AU dev teams we talk to are still running Claude Code in fully interactive mode out of caution, which is reasonable until the guardrails are actually configured. Getting a team from interactive-only to Nuro's model, hard-deny list plus classifier plus selective interactive review, is typically a half-day engagement, around A$1,200 to A$2,000 depending on how many repos and environments are in scope.
If your team is sitting on the fence about auto mode because nobody has set the guardrails up properly, book a brainstorm and we will help you configure it before your next Claude Code renewal.
