Tomorrow, August 14, Anthropic flips a switch that changes how every new Claude Code session behaves. Auto mode — where the agent executes tools without asking for permission on each step — becomes the default for Pro, Max, and Team plans. This isn't a UI tweak. It's a fundamental shift in the trust boundary between you and your coding agent.
Until now, most developers have run Claude Code in "manual" or "accept edits" mode, approving every file write, shell command, and git operation. The agent proposes, you dispose. Starting tomorrow, new sessions will default to "auto" — the agent proposes and executes until it hits a configured boundary.
What Actually Changes
The permission model in Claude Code has three tiers:
- Manual — Every tool call requires approval. You see the diff, the command, the git operation. You say yes or no.
- Accept edits — File writes are auto-approved. Shell commands, git operations, and deletions still prompt.
- Auto — Everything runs. The agent reads, writes, executes, commits, and pushes until it completes the task or hits a hard stop.
Auto mode has existed for months behind a flag. What's new is that it becomes the default for new sessions on paid plans. Existing sessions keep their current mode. You can still switch back per-session with /permissions or set a global default in your config.
What the Agent Can Do in Auto Mode
In auto mode, Claude Code can:
- Read, write, and delete any file in your working directory
- Run arbitrary shell commands (
npm install,docker build,kubectl apply) - Stage, commit, and push git changes
- Create and merge pull requests via
ghCLI - Install packages, run migrations, restart services
What it cannot do (hard-coded boundaries):
- Access files outside the working directory (no
~/.ssh, no/etc) - Run commands that require
sudoor root - Modify its own permission configuration
- Send network requests to arbitrary endpoints (only configured MCP servers)
The Risk Surface
The Reddit thread that surfaced this change (r/ClaudeAI) captures the tension well. Developers who've been burned by agents going "three steps past what I actually wanted" are wary. The concerns cluster around three failure modes:
1. Cascading edits
You ask for a refactor. The agent touches 30 files. One introduces a subtle bug. In manual mode, you'd catch it at file 3. In auto mode, you see the final result — or the broken build.
2. Destructive operations
rm -rf, git push --force, drop database. These require explicit confirmation today. In auto mode, they're just tools the agent can call if it thinks they're necessary. The guardrails exist but they're not foolproof.
3. Supply chain actions
npm install pulls dependencies. pip install runs setup.py. In auto mode, the agent can add a dependency and install it in one flow. Malicious or compromised packages become a real vector.
How to Prepare
Set your global default now
If you want to stay on manual or accept-edits by default, configure it before tomorrow:
# In ~/.claude/settings.json or project .claude/settings.json
{
"permissions": {
"defaultMode": "acceptEdits" // or "manual"
}
}
Use per-project overrides
Auto mode might make sense for greenfield prototypes. It's riskier for production codebases. Put a .claude/settings.json in each repo:
{
"permissions": {
"defaultMode": "manual"
}
}
Enable git safety nets
Auto mode can commit and push. Protect yourself:
- Branch protection rules on
main/master(require PR reviews, status checks) - Signed commits required
pre-pushhooks that run tests
Use worktrees for risky tasks
If you want to let the agent run wild on a refactor, spin up a worktree:
git worktree add ../myproject-auto main
cd ../myproject-auto
# Run Claude Code in auto mode here
# If it breaks things, your main worktree is untouched
Review the diff before you ship
Auto mode doesn't mean "no review." It means "review at the end instead of during." When the agent says it's done, run:
git diff HEAD~1 # or whatever the baseline is
Treat the agent's output as a PR you're reviewing, not as trusted code.
What This Means for Background Jobs
Anthropic also shipped background job support around the same time. Combined with auto mode, the vision is clear: "set it running and check back." You can now launch a long-running task in a tmux session or background job, and the agent will work through a multi-step plan without blocking your terminal.
This is powerful for:
- Large refactors with clear acceptance criteria
- Test generation for legacy code
- Documentation sweeps
- Dependency upgrades with known migration paths
It's dangerous for:
- Architectural decisions with tradeoffs
- Security-sensitive changes (auth, secrets, permissions)
- Database migrations without rollback plans
- Anything where "oops" costs more than "wait"
The Bigger Picture
This default change signals Anthropic's confidence that their sandboxing and permission model is robust enough for default-on autonomy. It also signals where the product is going: less pair-programming, more delegation.
For developers, the skill that matters shifts from "writing code with an AI" to "defining tasks, setting boundaries, and verifying outcomes." The agent becomes a parallel worker, not an interactive assistant.
If you've been treating Claude Code as a smarter autocomplete, tomorrow is a good day to start treating it as a junior developer you manage — with clear specs, guardrails, and code review.
Everything the lab builds in public stays in public. The source is on GitHub, and the current build is a live AI quoting engine for home service contractors.