Zero out of 720. That’s the prompt injection number Anthropic is leaning on to justify changing how millions of developers will use its coding agent by default.
An independent audit by Trajectory Labs ran 72 attack scenarios ten times each against Claude Code in Auto Mode. None of the 720 attempts succeeded against the company’s current models, Fable 5, Opus 5 and Sonnet 5. Run against OpenAI’s GPT-5.6 Sol in Codex Auto-Review mode, 5.83 percent of the same attacks got through.
Starting August 14, Claude Code ships with Auto Mode enabled by default on Pro, Max and Team plans, Anthropic said in a blog post. Enterprise customers still have to opt in.
What the classifier does instead of you
Auto Mode lets the tool work without pausing for manual approval at every step. A classifier checks whether an action is dangerous or irreversible, and only then does it stop and ask.
So the approval prompt doesn’t disappear. It just stops firing on the routine stuff, which is where developers were rubber-stamping anyway.
More pull requests isn’t the same as better ones
Anthropic tested Auto Mode with 1,053 paid testers alongside internal red-teaming, and said it performed at least as safely as manual approvals, and often better. Teams using it also generated about 25 percent more pull requests.
Read that second number carefully. It measures throughput, not correctness. A team shipping a quarter more PRs is a team with a quarter more code to review, and the review burden is exactly what Auto Mode shifts onto you.
Two saves from inside the company
Anthropic says Auto Mode stopped Claude from uploading confidential data to a public page internally. During one long session, it also killed roughly 2,000 processes that would have disrupted ongoing GPU training jobs.
Those are the kind of specifics that beat a safety score, because you can picture the incident that didn’t happen.
Who pays for the safety layer
Anthropic doesn’t charge for the tokens the classifier itself consumes, which sounds generous until you follow the rest of the math. When Claude works longer and finishes more, total token usage climbs and so does revenue. The company says that wasn’t the main motivation, and the incentive still points the same direction.
The advice that contradicts the default
Claude Code is currently the most widely used AI coding tool by a wide margin, and flipping this switch pushes the developer’s job further from writing code toward reviewing what the model wrote. Anthropic urges caution about that itself.
The classifier reduces risk without eliminating it. “For high-stakes changes to production infrastructure, we still recommend reviewing Claude’s actions yourself,” the company writes.
Which sets up a real problem. The less often you step in, the more each intervention matters, and the harder it gets to build deep familiarity with a codebase that Auto Mode largely wrote. Cybersecurity keeps getting faster and more complicated than any person can track.
If you’re on Pro, Max or Team, this happens to you on August 14 whether you asked for it or not. Spend an afternoon before then finding out where the classifier draws its line on your infrastructure, because the first time you find out shouldn’t be during a production deploy.
