Claude Code / Safety
A classifier caught more danger
than the humans clicking "approve."
Are developers actually reading Claude Code's approval prompts? In Anthropic's own testing, human reviewers caught dangerous commands only 13.6% of the time. Starting August 14, the primary judgment call shifts to an AI classifier instead.
The Problem
Approval prompts quietly became
a box people rubber-stamped
Claude Code's default permissions have always been deliberately conservative: every file write and every bash command prompts the developer for confirmation. The goal was safety, but in practice a lot of developers slipped into "approval fatigue" — clicking through dialogs without really reading them.
Anthropic's internal testing put a number on exactly how bad that got. Human reviewers correctly stopped dangerous commands only 13.6% of the time. The core design premise — that a human is the last line of defense — turned out not to hold up against the actual data.
"Dangerous commands" here means things like an irreversible rm -rf, a pipe that executes an external script sight unseen, or a history-rewriting git push --force. When an approval dialog fires dozens of times a day, a developer's attention doesn't stay sharp enough to catch one of those buried in the noise. If anything, familiarity with "an action I see all the time" made it easier to wave through the dangerous ones.
How It Works
Only genuinely risky actions
get sent back to a human
Starting August 14, Anthropic is making "Auto Mode" the default for Pro, Max, and Team plans. A classifier judges every action automatically and routes only the genuinely high-risk commands to a human for confirmation.
| Old approval flow | Auto Mode (as default) |
|---|---|
| Confirmation on every write/execute | Classifier judges automatically |
| Humans click through mechanically | Only truly risky actions reach a human |
| 13.6% danger detection rate | 89% danger detection rate |
| Work stalls waiting on confirmation | ~25% more PRs generated |
So What
What to check before the switch
Why this matters now. Agentic coding tools have long assumed, implicitly, that a human's eyes are the last safety net. The 13.6% figure disclosed on the official Anthropic blog is a notable admission that this premise itself wasn't working. It marks a turn away from "a human checked it, so it's safe."
Who benefits, and how. Developers who lean heavily on Claude Code agentically, running multiple tasks in parallel, get the biggest benefit — fewer bottlenecks waiting on confirmation, and, per The Decoder's report, roughly 25% more PRs generated. If you only use it occasionally or hand it small changes, you likely won't notice much difference. For PMs and engineering managers, a shift in total team output is also a reason to revisit assumptions baked into sprint planning.
What to do next. Three realistic first steps: (1) before the August 14 default switch, manually enable Auto Mode on a current project and observe its behavior; (2) for repos close to production, confirm you can still switch back to manual-approval mode after the default changes; (3) if you work on a team, align on how Auto Mode behaves and make sure everyone agrees on what counts as a "risky" action.
Counterpoint and risk. An 89% detection rate also means the classifier can still miss roughly one in ten dangerous commands. That's a huge improvement over 13.6%, but it isn't zero. There's also a risk of new complacency — "the AI will catch it, so it's fine." You can always switch back to manual, but when the default itself changes, some number of users will keep running on the new default without ever noticing the switch happened.
There's a compliance angle too. Development teams in regulated industries like finance or healthcare sometimes need an audit log of who approved what, and when. Once approvals shift to an automated classifier, it's worth checking with your own security and legal teams — before the default switches — how much of the classifier's reasoning survives as an auditable record. The classifier is itself a model, so its judging criteria can shift with a future update — an action judged "safe" today could become "needs confirmation" in a later version. Plan for that kind of non-determinism over a long deployment.
Not "a human is watching, so it's safe" —
redesigned around the fact that no one was.