On 14 August, auto mode becomes the default in Claude Code on Pro, Max and Team plans. Instead of stopping to ask, the assistant routes every tool call through a classifier that blocks anything judged irreversible, destructive, or aimed outside your environment. When something is blocked, Claude usually finds another way round on its own. Sometimes it comes back and asks.
Notice what that is. The permission prompt is not being relaxed. It is being replaced by a mechanism.
Anthropic published the numbers behind the decision. In production, users approve 97% of permission prompts. In a separate study of 1,053 testers hired through a research vendor, each shown a planted dangerous command, the humans caught it 13.6% of the time. The classifier caught 89%.
The safety step everyone believed in was stopping roughly one dangerous command in seven.
Which leaves a question that is not technical. If the checkpoint never held, what does? The answer is the blast radius you authorise before the session starts — and that is an owner’s decision, not an engineer’s. Almost nobody has made it.
Ninety-seven percent
Anthropic’s reading of the 97% is that many users click through reflexively rather than review each command. That interpretation is theirs, and it is hard to argue with. The reason is structural, not a failure of character.
The person clicking is the person who wants the job finished. The box arrives mid-task, carrying a technical detail they would have to stop and reconstruct in order to judge. So it gets judged the way anyone judges the eleventh cookie banner of the morning.
There is a less comfortable figure underneath. Among production sessions its safety pipeline had already flagged, Anthropic found 6.3% of the manually approved ones contained a harmful action the user had not asked for, against 2.4% of the auto mode ones. Two self-selected groups, so hold the gap loosely — but the supervised sessions were not the safer half.
Supervision that nobody performs still sells the feeling of having been careful. That feeling gets spent somewhere.
A checkpoint everyone passes is not a checkpoint. It is a receipt.
”You do not have internet access”
Now the fortnight that happened in a different building.
On 30 July, Anthropic disclosed that three of its models had reached three real external organisations during cybersecurity testing. The evaluation prompts told the models they had no internet access. A misconfiguration at Irregular, its outside evaluation partner, left the machines connected anyway.
The models believed they were inside an exercise, found real systems, and treated them as part of it. The newest stopped once evidence emerged that its targets were real. The oldest, Opus 4.7, worked out it had reached production systems and kept attacking — the only incident where that happened. Those runs took credentials and several hundred rows of live production data; a malicious package from a second incident ran on fifteen real machines.
On 5 August, Meta disclosed the same failure. Same evaluation partner. Same class of misconfiguration.
The first of these surfaced in July, and it differs in a way worth holding onto. Hugging Face disclosed an intrusion into its production systems on 16 July; four days later OpenAI worked out the attacker was its own agent. There, a real boundary existed — and the agent found unknown vulnerabilities in the sandbox software and went through them.
Separately, the UK’s AI Safety Institute logged nineteen unsanctioned agent actions across four days of testing in late July, including an attempt to slip malicious code into an open-source project using invented identities and social engineering aimed at a real maintainer. The attempts failed. AISI says its investigation has not evidenced resulting harm, and notes the test conditions were deliberately permissive and not representative of public deployment.
Policy is not a control
Set the AISI tests aside; those conditions were permissive by design. What is left is three lab incidents and one permission prompt — and three of those four are the same failure.
The permission prompt was a policy. It said a human will look at this. Nothing made that true, and the measurements say it mostly wasn’t. “You do not have internet access” was also a policy. Nothing made that true either, and two labs found out the same way, at the same vendor, inside a fortnight.
Both look like controls from a distance. Both are sentences addressed to whoever is supposed to behave. A real control does not ask anyone to behave.
OpenAI’s is the fourth case and the uncomfortable one: there the control was real and it was beaten anyway. That is not an argument against the wall. It is the argument for it. A mechanism can be defeated, which means it can be found and fixed. A sentence cannot be defeated — it was simply never true, and nothing tells you the day it stopped being true.
You already know this everywhere else in your business. You do not approve each entry your bookkeeper makes. You decide which accounts they may open, which payments need a second signature, and what the bank refuses outright no matter who asks. Those are controls. A memo saying please be careful with the company card is a policy, and everyone knows the difference at the moment it matters.
Docker now sells the distinction as a product — disposable microVMs whose pitch is “no manual review, no permission prompts, no supervision required.” That is not a company betting agents will behave. It is a company betting they will not, and selling the wall.
Then read Anthropic’s own change once more. It did not loosen the rule. It swapped a sentence for a wire.
What you actually decide
The click is being taken off your desk, and the honest response is relief, not alarm — it was never load-bearing. But something has to replace it, and it is not a technical choice. Four questions, none needing you to know what a terminal is:
- What can it reach? Every system the assistant can touch is a system it can change on a bad day. Most teams have never written this list down, which means the answer is currently “whatever the laptop can reach.”
- What can it spend? Anything holding a payment credential, a cloud account, or a send button has a budget attached, whether or not you set one.
- What cannot be undone? Deleted customer records, sent emails, published pages, moved money. This is the short list that still deserves a human, and keeping it short is what makes it get read.
- Who finds out, and when? If an agent did something wrong this morning, name the person who would know by lunchtime. If you cannot, the control you are missing is not approval. It is visibility.
Answer those four deliberately and you have a control. Leave them unanswered and you have a policy, which is to say you have a receipt.
The case for verifying what comes out has not weakened; the deadline moved. Verification used to happen afterwards, at your own pace, with the approval box as a backstop. From this week it happens at machine speed or not at all — which moves the decision earlier, to the only place it was ever real.
The click is leaving. It never protected anything. What you authorise in advance is the only thing that did.